From b89f8b84107faa11d84ea3dd6f52b84807051aea Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 29 Jul 2024 11:32:01 +0530
Subject: [PATCH 1/4] add gateway and gatewayclass support

---
 adapter/config/default_config.go              |    2 +
 adapter/config/types.go                       |    5 +-
 adapter/go.mod                                |   42 +-
 adapter/go.sum                                |   68 +-
 adapter/internal/adapter/adapter.go           |   79 +-
 .../internal/oasparser/envoyconf/constants.go |    1 -
 .../internal/operator/constants/constants.go  |    3 +
 .../controllers/dp/tokenissuer_controller.go  |   10 +-
 .../internal/operator/gateway-api/address.go  |   49 +
 .../gateway-api/bootstrap/bootstrap.go        |  226 ++
 .../gateway-api/bootstrap/bootstrap.yaml.tpl  |  191 ++
 .../gateway-api/bootstrap/bootstrap_test.go   |  128 +
 .../bootstrap/testdata/merge/default.in.yaml  |   13 +
 .../bootstrap/testdata/merge/default.out.yaml |  118 +
 .../testdata/merge/stats_sinks.in.yaml        |   34 +
 .../testdata/merge/stats_sinks.out.yaml       |  140 ++
 .../testdata/render/custom-stats-matcher.yaml |  112 +
 .../testdata/render/disable-prometheus.yaml   |  101 +
 .../testdata/render/enable-prometheus.yaml    |  101 +
 .../testdata/render/otel-metrics.yaml         |  126 +
 .../internal/operator/gateway-api/contexts.go |  453 ++++
 .../operator/gateway-api/crypto/certgen.go    |  321 +++
 .../gateway-api/crypto/certgen_test.go        |  174 ++
 .../gateway-api/envoy/shutdown_manager.go     |  238 ++
 .../internal/operator/gateway-api/filters.go  |  792 ++++++
 .../internal/operator/gateway-api/helpers.go  |  461 ++++
 .../operator/gateway-api/helpers_v1alpha2.go  |  205 ++
 .../infrastructure/kubernetes/infra.go        |  135 +
 .../infrastructure/kubernetes/infra_client.go |   89 +
 .../kubernetes/infra_resource.go              |  209 ++
 .../kubernetes/proxy/resource.go              |  728 ++++++
 .../kubernetes/proxy/resource_provider.go     |  351 +++
 .../proxy/resource_provider_test.go           |  989 ++++++++
 .../kubernetes/proxy/resource_test.go         |   56 +
 .../proxy/testdata/configmap/default.yaml     |   14 +
 .../testdata/configmap/with-annotations.yaml  |   17 +
 .../proxy/testdata/deployments/bootstrap.yaml |  296 +++
 .../testdata/deployments/component-level.yaml |  297 +++
 .../proxy/testdata/deployments/custom.yaml    |  311 +++
 .../custom_with_initcontainers.yaml           |  328 +++
 .../testdata/deployments/default-env.yaml     |  310 +++
 .../proxy/testdata/deployments/default.yaml   |  296 +++
 .../deployments/disable-prometheus.yaml       |  264 ++
 .../testdata/deployments/extension-env.yaml   |  313 +++
 .../override-labels-and-annotations.yaml      |  307 +++
 .../deployments/patch-deployment.yaml         |  297 +++
 .../deployments/shutdown-manager.yaml         |  309 +++
 .../proxy/testdata/deployments/volumes.yaml   |  313 +++
 .../deployments/with-annotations.yaml         |  301 +++
 .../deployments/with-concurrency.yaml         |  297 +++
 .../testdata/deployments/with-extra-args.yaml |  298 +++
 .../deployments/with-image-pull-secrets.yaml  |  299 +++
 .../deployments/with-node-selector.yaml       |  299 +++
 .../with-topology-spread-constraints.yaml     |  305 +++
 .../kubernetes/proxy/testdata/hpa/custom.yaml |   28 +
 .../proxy/testdata/hpa/default.yaml           |   21 +
 .../proxy/testdata/hpa/with-annotations.yaml  |   24 +
 .../testdata/serviceaccount/default.yaml      |   11 +
 .../serviceaccount/with-annotations.yaml      |   14 +
 .../services/clusterIP-custom-addresses.yaml  |   32 +
 .../proxy/testdata/services/custom.yaml       |   31 +
 .../proxy/testdata/services/default.yaml      |   30 +
 .../services/override-annotations.yaml        |   37 +
 .../testdata/services/patch-service.yaml      |   30 +
 .../testdata/services/with-annotations.yaml   |   33 +
 .../kubernetes/proxy_configmap_test.go        |  187 ++
 .../kubernetes/proxy_deployment_test.go       |  162 ++
 .../infrastructure/kubernetes/proxy_infra.go  |   55 +
 .../kubernetes/proxy_infra_test.go            |  180 ++
 .../kubernetes/proxy_service_test.go          |   60 +
 .../kubernetes/resource/resource.go           |  131 +
 .../kubernetes/resource/resource_test.go      |  553 ++++
 .../gateway-api/infrastructure/manager.go     |   57 +
 .../internal/operator/gateway-api/ir/infra.go |  274 ++
 .../operator/gateway-api/ir/infra_test.go     |  263 ++
 .../operator/gateway-api/ir/protocol.go       |   44 +
 .../internal/operator/gateway-api/ir/xds.go   | 1749 +++++++++++++
 .../operator/gateway-api/ir/xds_test.go       | 1438 +++++++++++
 .../gateway-api/ir/zz_generated.deepcopy.go   | 2221 +++++++++++++++++
 .../internal/operator/gateway-api/listener.go |  191 ++
 .../provider/kubernetes/controller.go         |  744 ++++++
 .../provider/kubernetes/helpers.go            |  151 ++
 .../provider/kubernetes/indexers.go           |  399 +++
 .../provider/kubernetes/kubernetes.go         |  112 +
 .../provider/kubernetes/predicates.go         |  262 ++
 .../provider/kubernetes/predicates_test.go    |   89 +
 .../gateway-api/provider/kubernetes/routes.go |  189 ++
 .../gateway-api/provider/kubernetes/status.go |  137 +
 .../gateway-api/provider/kubernetes/store.go  |   93 +
 .../provider/kubernetes/store_test.go         |  111 +
 .../operator/gateway-api/provider/scheme.go   |   70 +
 .../internal/operator/gateway-api/resource.go |  168 ++
 .../internal/operator/gateway-api/route.go    | 1340 ++++++++++
 .../internal/operator/gateway-api/secrets.go  |  153 ++
 .../operator/gateway-api/secrets_test.go      |  114 +
 adapter/internal/operator/gateway-api/sort.go |  124 +
 .../testdata/backendtlspolicy-ca-only.in.yaml |  137 +
 .../backendtlspolicy-ca-only.out.yaml         |  169 ++
 .../backendtlspolicy-default-ns.in.yaml       |  137 +
 .../backendtlspolicy-default-ns.out.yaml      |  168 ++
 .../backendtlspolicy-invalid-ca.in.yaml       |  119 +
 .../backendtlspolicy-invalid-ca.out.yaml      |  164 ++
 ...backendtlspolicy-system-truststore.in.yaml |  105 +
 ...ackendtlspolicy-system-truststore.out.yaml |  163 ++
 ...ndtlspolicy-without-referencegrant.in.yaml |  134 +
 ...dtlspolicy-without-referencegrant.out.yaml |  165 ++
 ...kendtrafficpolicy-override-replace.in.yaml |   89 +
 ...endtrafficpolicy-override-replace.out.yaml |  271 ++
 ...endtrafficpolicy-status-conditions.in.yaml |  207 ++
 ...ndtrafficpolicy-status-conditions.out.yaml |  621 +++++
 ...afficpolicy-status-fault-injection.in.yaml |  135 +
 ...fficpolicy-status-fault-injection.out.yaml |  430 ++++
 ...cpolicy-with-circuitbreakers-error.in.yaml |  123 +
 ...policy-with-circuitbreakers-error.out.yaml |  394 +++
 ...trafficpolicy-with-circuitbreakers.in.yaml |   99 +
 ...rafficpolicy-with-circuitbreakers.out.yaml |  328 +++
 ...kendtrafficpolicy-with-healthcheck.in.yaml |  239 ++
 ...endtrafficpolicy-with-healthcheck.out.yaml |  648 +++++
 ...endtrafficpolicy-with-loadbalancer.in.yaml |  142 ++
 ...ndtrafficpolicy-with-loadbalancer.out.yaml |  443 ++++
 ...atelimit-default-route-level-limit.in.yaml |   71 +
 ...telimit-default-route-level-limit.out.yaml |  213 ++
 ...local-ratelimit-invalid-limit-unit.in.yaml |   74 +
 ...ocal-ratelimit-invalid-limit-unit.out.yaml |  186 ++
 ...local-ratelimit-invalid-match-type.in.yaml |   71 +
 ...ocal-ratelimit-invalid-match-type.out.yaml |  182 ++
 ...nvalid-multiple-route-level-limits.in.yaml |   77 +
 ...valid-multiple-route-level-limits.out.yaml |  189 ++
 ...trafficpolicy-with-local-ratelimit.in.yaml |   74 +
 ...rafficpolicy-with-local-ratelimit.out.yaml |  216 ++
 ...ndtrafficpolicy-with-proxyprotocol.in.yaml |   91 +
 ...dtrafficpolicy-with-proxyprotocol.out.yaml |  312 +++
 ...olicy-with-ratelimit-invalid-regex.in.yaml |   56 +
 ...licy-with-ratelimit-invalid-regex.out.yaml |  164 ++
 ...ackendtrafficpolicy-with-ratelimit.in.yaml |  111 +
 ...ckendtrafficpolicy-with-ratelimit.out.yaml |  352 +++
 .../backendtrafficpolicy-with-retries.in.yaml |  110 +
 ...backendtrafficpolicy-with-retries.out.yaml |  350 +++
 ...policy-with-same-prefix-httproutes.in.yaml |   70 +
 ...olicy-with-same-prefix-httproutes.out.yaml |  224 ++
 ...endtrafficpolicy-with-tcpkeepalive.in.yaml |   95 +
 ...ndtrafficpolicy-with-tcpkeepalive.out.yaml |  320 +++
 ...ndtrafficpolicy-with-timeout-error.in.yaml |   49 +
 ...dtrafficpolicy-with-timeout-error.out.yaml |  155 ++
 .../backendtrafficpolicy-with-timeout.in.yaml |   99 +
 ...backendtrafficpolicy-with-timeout.out.yaml |  328 +++
 .../testdata/disable-accesslog.in.yaml        |   73 +
 .../testdata/disable-accesslog.out.yaml       |  130 +
 .../envoypatchpolicy-cross-ns-target.in.yaml  |   35 +
 .../envoypatchpolicy-cross-ns-target.out.yaml |   83 +
 ...tchpolicy-invalid-feature-disabled.in.yaml |   43 +
 ...chpolicy-invalid-feature-disabled.out.yaml |   92 +
 ...invalid-target-kind-merge-gateways.in.yaml |   43 +
 ...nvalid-target-kind-merge-gateways.out.yaml |   94 +
 ...voypatchpolicy-invalid-target-kind.in.yaml |   35 +
 ...oypatchpolicy-invalid-target-kind.out.yaml |   84 +
 ...licy-no-status-for-unknown-gateway.in.yaml |   13 +
 ...icy-no-status-for-unknown-gateway.out.yaml |    2 +
 ...oypatchpolicy-valid-merge-gateways.in.yaml |   64 +
 ...ypatchpolicy-valid-merge-gateways.out.yaml |  115 +
 .../testdata/envoypatchpolicy-valid.in.yaml   |   56 +
 .../testdata/envoypatchpolicy-valid.out.yaml  |  105 +
 ...roxy-accesslog-file-json-no-format.in.yaml |   79 +
 ...oxy-accesslog-file-json-no-format.out.yaml |  137 +
 .../envoyproxy-accesslog-file-json.in.yaml    |   82 +
 .../envoyproxy-accesslog-file-json.out.yaml   |  145 ++
 ...nvoyproxy-accesslog-with-bad-sinks.in.yaml |   80 +
 ...voyproxy-accesslog-with-bad-sinks.out.yaml |  138 +
 .../testdata/envoyproxy-accesslog.in.yaml     |   87 +
 .../testdata/envoyproxy-accesslog.out.yaml    |  156 ++
 .../testdata/envoyproxy-valid.in.yaml         |   70 +
 .../testdata/envoyproxy-valid.out.yaml        |  130 +
 ...ith-extension-filter-invalid-group.in.yaml |   50 +
 ...th-extension-filter-invalid-group.out.yaml |  120 +
 ...with-non-matching-extension-filter.in.yaml |   50 +
 ...ith-non-matching-extension-filter.out.yaml |  118 +
 ...-with-unsupported-extension-filter.in.yaml |   50 +
 ...with-unsupported-extension-filter.out.yaml |  118 +
 ...proute-with-valid-extension-filter.in.yaml |   50 +
 ...route-with-valid-extension-filter.out.yaml |  147 ++
 ...e-namespace-with-allowed-httproute.in.yaml |   63 +
 ...-namespace-with-allowed-httproute.out.yaml |  127 +
 ...amespace-with-disallowed-httproute.in.yaml |   32 +
 ...mespace-with-disallowed-httproute.out.yaml |  107 +
 .../testdata/gateway-infrastructure.in.yaml   |   76 +
 .../testdata/gateway-infrastructure.out.yaml  |  150 ++
 ...eway-with-addresses-with-ipaddress.in.yaml |   19 +
 ...way-with-addresses-with-ipaddress.out.yaml |   67 +
 ...nvalid-allowed-namespaces-selector.in.yaml |   38 +
 ...valid-allowed-namespaces-selector.out.yaml |   92 +
 ...-with-invalid-allowed-routes-group.in.yaml |   35 +
 ...with-invalid-allowed-routes-group.out.yaml |   83 +
 ...-allowed-routes-kind-and-supported.in.yaml |   37 +
 ...allowed-routes-kind-and-supported.out.yaml |   85 +
 ...r-with-invalid-allowed-routes-kind.in.yaml |   35 +
 ...-with-invalid-allowed-routes-kind.out.yaml |   83 +
 ...ith-invalid-allowed-tls-route-kind.in.yaml |   35 +
 ...th-invalid-allowed-tls-route-kind.out.yaml |   83 +
 ...invalid-multiple-tls-configuration.in.yaml |   66 +
 ...nvalid-multiple-tls-configuration.out.yaml |   98 +
 ...lid-tls-configuration-invalid-mode.in.yaml |   47 +
 ...id-tls-configuration-invalid-mode.out.yaml |   91 +
 ...-configuration-no-certificate-refs.in.yaml |   44 +
 ...configuration-no-certificate-refs.out.yaml |   86 +
 ...tion-no-valid-certificate-for-fqdn.in.yaml |   47 +
 ...ion-no-valid-certificate-for-fqdn.out.yaml |   93 +
 ...onfiguration-secret-does-not-exist.in.yaml |   36 +
 ...nfiguration-secret-does-not-exist.out.yaml |   90 +
 ...guration-secret-in-other-namespace.in.yaml |   47 +
 ...uration-secret-in-other-namespace.out.yaml |   92 +
 ...-configuration-secret-is-not-valid.in.yaml |   45 +
 ...configuration-secret-is-not-valid.out.yaml |   90 +
 ...issing-allowed-namespaces-selector.in.yaml |   32 +
 ...ssing-allowed-namespaces-selector.out.yaml |   85 +
 ...th-listener-with-tcp-with-hostname.in.yaml |   16 +
 ...h-listener-with-tcp-with-hostname.out.yaml |   48 +
 ...proute-with-mismatch-port-protocol.in.yaml |   29 +
 ...route-with-mismatch-port-protocol.out.yaml |   92 +
 ...th-tcproute-with-multiple-backends.in.yaml |   33 +
 ...h-tcproute-with-multiple-backends.out.yaml |   96 +
 ...-with-tcproute-with-multiple-rules.in.yaml |   34 +
 ...with-tcproute-with-multiple-rules.out.yaml |   97 +
 ...ther-namespace-allowed-by-refgrant.in.yaml |   61 +
 ...her-namespace-allowed-by-refgrant.out.yaml |  139 ++
 ...with-tls-terminate-and-passthrough.in.yaml |   70 +
 ...ith-tls-terminate-and-passthrough.out.yaml |  225 ++
 ...th-listener-with-udp-with-hostname.in.yaml |   16 +
 ...h-listener-with-udp-with-hostname.out.yaml |   48 +
 ...proute-with-mismatch-port-protocol.in.yaml |   29 +
 ...route-with-mismatch-port-protocol.out.yaml |   92 +
 ...th-udproute-with-multiple-backends.in.yaml |   33 +
 ...h-udproute-with-multiple-backends.out.yaml |   96 +
 ...-with-udproute-with-multiple-rules.in.yaml |   34 +
 ...with-udproute-with-multiple-rules.out.yaml |   97 +
 ...h-listener-with-unmatched-tcproute.in.yaml |   29 +
 ...-listener-with-unmatched-tcproute.out.yaml |   60 +
 ...h-listener-with-unmatched-udproute.in.yaml |   29 +
 ...-listener-with-unmatched-udproute.out.yaml |   60 +
 ...listener-with-unsupported-protocol.in.yaml |   32 +
 ...istener-with-unsupported-protocol.out.yaml |   85 +
 ...with-same-algorithm-different-fqdn.in.yaml |   56 +
 ...ith-same-algorithm-different-fqdn.out.yaml |  144 ++
 ...h-valid-multiple-tls-configuration.in.yaml |   56 +
 ...-valid-multiple-tls-configuration.out.yaml |  144 ++
 ...tener-with-valid-tls-configuration.in.yaml |   46 +
 ...ener-with-valid-tls-configuration.out.yaml |  138 +
 ...-with-preexisting-status-condition.in.yaml |   55 +
 ...with-preexisting-status-condition.out.yaml |  127 +
 ...e-listener-with-multiple-tcproutes.in.yaml |   42 +
 ...-listener-with-multiple-tcproutes.out.yaml |  137 +
 ...e-listener-with-multiple-udproutes.in.yaml |   42 +
 ...-listener-with-multiple-udproutes.out.yaml |  136 +
 ...ateway-with-stale-status-condition.in.yaml |   69 +
 ...teway-with-stale-status-condition.out.yaml |  138 +
 ...-listeners-on-same-tcp-or-tls-port.in.yaml |   35 +
 ...listeners-on-same-tcp-or-tls-port.out.yaml |  135 +
 ...ith-two-listeners-on-same-udp-port.in.yaml |   35 +
 ...th-two-listeners-on-same-udp-port.out.yaml |  132 +
 ...nd-tlsroute-same-hostname-and-port.in.yaml |   56 +
 ...d-tlsroute-same-hostname-and-port.out.yaml |  152 ++
 ...listeners-with-multiple-httproutes.in.yaml |   56 +
 ...isteners-with-multiple-httproutes.out.yaml |  266 ++
 ...teners-with-same-port-and-hostname.in.yaml |   40 +
 ...eners-with-same-port-and-hostname.out.yaml |  120 +
 ...ame-port-and-incompatible-protocol.in.yaml |   40 +
 ...me-port-and-incompatible-protocol.out.yaml |  120 +
 ...s-with-same-port-http-tcp-protocol.in.yaml |   53 +
 ...-with-same-port-http-tcp-protocol.out.yaml |  208 ++
 ...s-with-same-port-http-udp-protocol.in.yaml |   53 +
 ...-with-same-port-http-udp-protocol.out.yaml |  207 ++
 ...rs-with-tcproutes-with-sectionname.in.yaml |   50 +
 ...s-with-tcproutes-with-sectionname.out.yaml |  188 ++
 ...with-tcproutes-without-sectionname.in.yaml |   48 +
 ...ith-tcproutes-without-sectionname.out.yaml |  184 ++
 ...rs-with-udproutes-with-sectionname.in.yaml |   50 +
 ...s-with-udproutes-with-sectionname.out.yaml |  186 ++
 ...with-udproutes-without-sectionname.in.yaml |   48 +
 ...ith-udproutes-without-sectionname.out.yaml |  182 ++
 .../grpcroute-with-empty-backends.in.yaml     |   31 +
 .../grpcroute-with-empty-backends.out.yaml    |  120 +
 .../grpcroute-with-header-match.in.yaml       |   35 +
 .../grpcroute-with-header-match.out.yaml      |  131 +
 ...oute-with-method-and-service-match.in.yaml |   39 +
 ...ute-with-method-and-service-match.out.yaml |  154 ++
 .../grpcroute-with-method-match.in.yaml       |   37 +
 .../grpcroute-with-method-match.out.yaml      |  152 ++
 ...route-with-request-header-modifier.in.yaml |   36 +
 ...oute-with-request-header-modifier.out.yaml |  132 +
 .../grpcroute-with-service-match.in.yaml      |   37 +
 .../grpcroute-with-service-match.out.yaml     |  152 ++
 ...ndtrafficpolicy-with-timeout-error.in.yaml |   54 +
 ...dtrafficpolicy-with-timeout-error.out.yaml |  169 ++
 ...-backendtrafficpolicy-with-timeout.in.yaml |  100 +
 ...backendtrafficpolicy-with-timeout.out.yaml |  329 +++
 ...eway-with-more-different-listeners.in.yaml |   82 +
 ...way-with-more-different-listeners.out.yaml |  590 +++++
 ...ing-to-gateway-with-more-listeners.in.yaml |   82 +
 ...ng-to-gateway-with-more-listeners.out.yaml |  541 ++++
 ...two-listeners-with-different-ports.in.yaml |   52 +
 ...wo-listeners-with-different-ports.out.yaml |  203 ++
 ...hing-to-gateway-with-two-listeners.in.yaml |   40 +
 ...ing-to-gateway-with-two-listeners.out.yaml |  187 ++
 .../httproute-attaching-to-gateway.in.yaml    |   32 +
 .../httproute-attaching-to-gateway.out.yaml   |  127 +
 ...ttaching-to-listener-matching-port.in.yaml |   34 +
 ...taching-to-listener-matching-port.out.yaml |  131 +
 ...ener-on-gateway-with-two-listeners.in.yaml |   41 +
 ...ner-on-gateway-with-two-listeners.out.yaml |  169 ++
 ...port-backendrefs-diff-address-type.in.yaml |   99 +
 ...ort-backendrefs-diff-address-type.out.yaml |  141 ++
 ...port-backendrefs-same-address-type.in.yaml |   99 +
 ...ort-backendrefs-same-address-type.out.yaml |  141 ++
 ...mport-backendref-fqdn-address-type.in.yaml |   66 +
 ...port-backendref-fqdn-address-type.out.yaml |  131 +
 ...port-backendref-mixed-address-type.in.yaml |   83 +
 ...ort-backendref-mixed-address-type.out.yaml |  133 +
 ...ener-with-serviceimport-backendref.in.yaml |   66 +
 ...ner-with-serviceimport-backendref.out.yaml |  131 +
 .../httproute-attaching-to-listener.in.yaml   |   33 +
 .../httproute-attaching-to-listener.out.yaml  |  129 +
 .../httproute-backend-request-timeout.in.yaml |   35 +
 ...httproute-backend-request-timeout.out.yaml |  134 +
 ...hing-to-listener-non-matching-port.in.yaml |   34 +
 ...ing-to-listener-non-matching-port.out.yaml |  110 +
 .../httproute-request-timeout.in.yaml         |   35 +
 .../httproute-request-timeout.out.yaml        |  134 +
 ...with-empty-backends-and-no-filters.in.yaml |   29 +
 ...ith-empty-backends-and-no-filters.out.yaml |  117 +
 ...h-multiple-backends-and-no-weights.in.yaml |   36 +
 ...-multiple-backends-and-no-weights.out.yaml |  143 ++
 ...with-multiple-backends-and-weights.in.yaml |   42 +
 ...ith-multiple-backends-and-weights.out.yaml |  149 ++
 ...ther-namespace-allowed-by-refgrant.in.yaml |   79 +
 ...her-namespace-allowed-by-refgrant.out.yaml |  129 +
 ...ther-namespace-allowed-by-refgrant.in.yaml |   81 +
 ...her-namespace-allowed-by-refgrant.out.yaml |  131 +
 .../httproute-with-empty-matches.in.yaml      |   31 +
 .../httproute-with-empty-matches.out.yaml     |  122 +
 ...ter-duplicate-add-multiple-filters.in.yaml |   52 +
 ...er-duplicate-add-multiple-filters.out.yaml |  157 ++
 ...-with-header-filter-duplicate-adds.in.yaml |   61 +
 ...with-header-filter-duplicate-adds.out.yaml |  173 ++
 ...-duplicate-remove-multiple-filters.in.yaml |   48 +
 ...duplicate-remove-multiple-filters.out.yaml |  147 ++
 ...th-header-filter-duplicate-removes.in.yaml |   42 +
 ...h-header-filter-duplicate-removes.out.yaml |  140 ++
 ...-header-filter-empty-header-values.in.yaml |   46 +
 ...header-filter-empty-header-values.out.yaml |  148 ++
 ...e-with-header-filter-empty-headers.in.yaml |   48 +
 ...-with-header-filter-empty-headers.out.yaml |  123 +
 ...with-header-filter-invalid-headers.in.yaml |   48 +
 ...ith-header-filter-invalid-headers.out.yaml |  124 +
 ...oute-with-header-filter-no-headers.in.yaml |   42 +
 ...ute-with-header-filter-no-headers.out.yaml |  135 +
 ...ith-header-filter-no-valid-headers.in.yaml |   42 +
 ...th-header-filter-no-valid-headers.out.yaml |  119 +
 ...ttproute-with-header-filter-remove.in.yaml |   43 +
 ...tproute-with-header-filter-remove.out.yaml |  143 ++
 ...-with-invalid-backend-ref-bad-port.in.yaml |   42 +
 ...with-invalid-backend-ref-bad-port.out.yaml |  121 +
 ...-invalid-backend-ref-invalid-group.in.yaml |   45 +
 ...invalid-backend-ref-invalid-group.out.yaml |  125 +
 ...h-invalid-backend-ref-invalid-kind.in.yaml |   35 +
 ...-invalid-backend-ref-invalid-kind.out.yaml |  122 +
 ...e-with-invalid-backend-ref-no-port.in.yaml |   41 +
 ...-with-invalid-backend-ref-no-port.out.yaml |  121 +
 ...alid-backend-ref-no-service.import.in.yaml |   35 +
 ...lid-backend-ref-no-service.import.out.yaml |  123 +
 ...ith-invalid-backend-ref-no-service.in.yaml |   33 +
 ...th-invalid-backend-ref-no-service.out.yaml |  121 +
 ...lid-backend-ref-unsupported-filter.in.yaml |   39 +
 ...id-backend-ref-unsupported-filter.out.yaml |  127 +
 ...alid-backendref-in-other-namespace.in.yaml |   44 +
 ...lid-backendref-in-other-namespace.out.yaml |  122 +
 .../httproute-with-invalid-regex.in.yaml      |   48 +
 .../httproute-with-invalid-regex.out.yaml     |  173 ++
 ...oute-with-mirror-filter-duplicates.in.yaml |   50 +
 ...ute-with-mirror-filter-duplicates.out.yaml |  162 ++
 ...proute-with-mirror-filter-multiple.in.yaml |   62 +
 ...route-with-mirror-filter-multiple.out.yaml |  186 ++
 ...with-mirror-filter-service-no-port.in.yaml |   42 +
 ...ith-mirror-filter-service-no-port.out.yaml |  139 ++
 ...th-mirror-filter-service-not-found.in.yaml |   43 +
 ...h-mirror-filter-service-not-found.out.yaml |  139 ++
 .../httproute-with-mirror-filter.in.yaml      |   43 +
 .../httproute-with-mirror-filter.out.yaml     |  148 ++
 ...-to-gateway-with-wildcard-hostname.in.yaml |   35 +
 ...to-gateway-with-wildcard-hostname.out.yaml |  111 +
 ...ect-filter-full-path-replace-https.in.yaml |   41 +
 ...ct-filter-full-path-replace-https.out.yaml |  136 +
 ...oute-with-redirect-filter-hostname.in.yaml |   39 +
 ...ute-with-redirect-filter-hostname.out.yaml |  132 +
 ...edirect-filter-invalid-filter-type.in.yaml |   43 +
 ...direct-filter-invalid-filter-type.out.yaml |  118 +
 ...ith-redirect-filter-invalid-scheme.in.yaml |   38 +
 ...th-redirect-filter-invalid-scheme.out.yaml |  115 +
 ...ith-redirect-filter-invalid-status.in.yaml |   39 +
 ...th-redirect-filter-invalid-status.out.yaml |  114 +
 ...lter-prefix-replace-with-port-http.in.yaml |   42 +
 ...ter-prefix-replace-with-port-http.out.yaml |  137 +
 ...e-with-response-header-filter-adds.in.yaml |   57 +
 ...-with-response-header-filter-adds.out.yaml |  169 ++
 ...ter-duplicate-add-multiple-filters.in.yaml |   52 +
 ...er-duplicate-add-multiple-filters.out.yaml |  157 ++
 ...ponse-header-filter-duplicate-adds.in.yaml |   61 +
 ...onse-header-filter-duplicate-adds.out.yaml |  173 ++
 ...-duplicate-remove-multiple-filters.in.yaml |   48 +
 ...duplicate-remove-multiple-filters.out.yaml |  147 ++
 ...se-header-filter-duplicate-removes.in.yaml |   42 +
 ...e-header-filter-duplicate-removes.out.yaml |  140 ++
 ...-header-filter-empty-header-values.in.yaml |   46 +
 ...header-filter-empty-header-values.out.yaml |  148 ++
 ...sponse-header-filter-empty-headers.in.yaml |   48 +
 ...ponse-header-filter-empty-headers.out.yaml |  123 +
 ...onse-header-filter-invalid-headers.in.yaml |   48 +
 ...nse-header-filter-invalid-headers.out.yaml |  124 +
 ...-response-header-filter-no-headers.in.yaml |   42 +
 ...response-header-filter-no-headers.out.yaml |  135 +
 ...nse-header-filter-no-valid-headers.in.yaml |   42 +
 ...se-header-filter-no-valid-headers.out.yaml |  119 +
 ...with-response-header-filter-remove.in.yaml |   43 +
 ...ith-response-header-filter-remove.out.yaml |  143 ++
 ...-single-rule-with-exact-path-match.in.yaml |   33 +
 ...single-rule-with-exact-path-match.out.yaml |  128 +
 ...single-rule-with-http-method-match.in.yaml |   31 +
 ...ingle-rule-with-http-method-match.out.yaml |  126 +
 ...th-single-rule-with-multiple-rules.in.yaml |   63 +
 ...h-single-rule-with-multiple-rules.out.yaml |  134 +
 ...th-prefix-and-exact-header-matches.in.yaml |   37 +
 ...h-prefix-and-exact-header-matches.out.yaml |  139 ++
 ...me-invalid-backend-refs-no-service.in.yaml |   46 +
 ...e-invalid-backend-refs-no-service.out.yaml |  132 +
 ...-to-gateway-with-wildcard-hostname.in.yaml |   35 +
 ...to-gateway-with-wildcard-hostname.out.yaml |  130 +
 ...-to-gateway-with-wildcard-hostname.in.yaml |   36 +
 ...to-gateway-with-wildcard-hostname.out.yaml |  150 ++
 ...rite-filter-full-path-replace-http.in.yaml |   42 +
 ...ite-filter-full-path-replace-http.out.yaml |  142 ++
 ...ite-filter-hostname-prefix-replace.in.yaml |   43 +
 ...te-filter-hostname-prefix-replace.out.yaml |  144 ++
 ...te-with-urlrewrite-filter-hostname.in.yaml |   40 +
 ...e-with-urlrewrite-filter-hostname.out.yaml |  138 +
 ...rewrite-filter-invalid-filter-type.in.yaml |   41 +
 ...ewrite-filter-invalid-filter-type.out.yaml |  138 +
 ...urlrewrite-filter-invalid-hostname.in.yaml |   43 +
 ...rlrewrite-filter-invalid-hostname.out.yaml |  122 +
 ...te-filter-invalid-multiple-filters.in.yaml |   48 +
 ...e-filter-invalid-multiple-filters.out.yaml |  124 +
 ...rlrewrite-filter-invalid-path-type.in.yaml |   43 +
 ...lrewrite-filter-invalid-path-type.out.yaml |  120 +
 ...ith-urlrewrite-filter-invalid-path.in.yaml |   43 +
 ...th-urlrewrite-filter-invalid-path.out.yaml |  119 +
 ...ith-urlrewrite-filter-missing-path.in.yaml |   41 +
 ...th-urlrewrite-filter-missing-path.out.yaml |  117 +
 ...rewrite-filter-prefix-replace-http.in.yaml |   42 +
 ...ewrite-filter-prefix-replace-http.out.yaml |  142 ++
 ...ing-to-gateway-with-unset-hostname.in.yaml |   34 +
 ...ng-to-gateway-with-unset-hostname.out.yaml |  129 +
 .../httproutes-with-multiple-matches.in.yaml  |  189 ++
 .../httproutes-with-multiple-matches.out.yaml |  436 ++++
 .../merge-invalid-multiple-gateways.in.yaml   |   34 +
 .../merge-invalid-multiple-gateways.out.yaml  |  147 ++
 ...ways-multiple-listeners-same-ports.in.yaml |   45 +
 ...ays-multiple-listeners-same-ports.out.yaml |  210 ++
 ...-multiple-gateways-multiple-routes.in.yaml |   81 +
 ...multiple-gateways-multiple-routes.out.yaml |  292 +++
 .../merge-valid-multiple-gateways.in.yaml     |   41 +
 .../merge-valid-multiple-gateways.out.yaml    |  174 ++
 ...ecuritypolicy-invalid-cross-ns-ref.in.yaml |   42 +
 ...curitypolicy-invalid-cross-ns-ref.out.yaml |  115 +
 ...tatus-for-unknown-gateway-or-route.in.yaml |   23 +
 ...atus-for-unknown-gateway-or-route.out.yaml |   31 +
 .../securitypolicy-override-replace.in.yaml   |  117 +
 .../securitypolicy-override-replace.out.yaml  |  338 +++
 .../securitypolicy-status-conditions.in.yaml  |  133 +
 .../securitypolicy-status-conditions.out.yaml |  436 ++++
 .../securitypolicy-with-basic-auth.in.yaml    |   58 +
 .../securitypolicy-with-basic-auth.out.yaml   |  166 ++
 .../testdata/securitypolicy-with-cors.in.yaml |  173 ++
 .../securitypolicy-with-cors.out.yaml         |  554 ++++
 ...h-extauth-invalid-no-matching-port.in.yaml |   65 +
 ...-extauth-invalid-no-matching-port.out.yaml |  167 ++
 ...olicy-with-extauth-invalid-no-port.in.yaml |   64 +
 ...licy-with-extauth-invalid-no-port.out.yaml |  167 ++
 ...extauth-invalid-no-reference-grant.in.yaml |   65 +
 ...xtauth-invalid-no-reference-grant.out.yaml |  168 ++
 ...cy-with-extauth-invalid-no-service.in.yaml |   56 +
 ...y-with-extauth-invalid-no-service.out.yaml |  167 ++
 ...with-extauth-with-backendtlspolicy.in.yaml |  231 ++
 ...ith-extauth-with-backendtlspolicy.out.yaml |  373 +++
 .../securitypolicy-with-extauth.in.yaml       |  165 ++
 .../securitypolicy-with-extauth.out.yaml      |  297 +++
 ...typolicy-with-jwt-and-invalid-oidc.in.yaml |  111 +
 ...ypolicy-with-jwt-and-invalid-oidc.out.yaml |  308 +++
 ...icy-with-jwt-with-custom-extractor.in.yaml |  126 +
 ...cy-with-jwt-with-custom-extractor.out.yaml |  382 +++
 .../testdata/securitypolicy-with-jwt.in.yaml  |  118 +
 .../testdata/securitypolicy-with-jwt.out.yaml |  366 +++
 ...itypolicy-with-oidc-invalid-issuer.in.yaml |   41 +
 ...typolicy-with-oidc-invalid-issuer.out.yaml |  108 +
 ...policy-with-oidc-invalid-secretref.in.yaml |  118 +
 ...olicy-with-oidc-invalid-secretref.out.yaml |  320 +++
 .../testdata/securitypolicy-with-oidc.in.yaml |  127 +
 .../securitypolicy-with-oidc.out.yaml         |  304 +++
 ...ateway-with-listener-tls-terminate.in.yaml |   46 +
 ...teway-with-listener-tls-terminate.out.yaml |  117 +
 .../gateway-api/testdata/tls/.gitignore       |    2 +
 .../testdata/tls/ecdsa-p256-cert.pem          |   11 +
 .../gateway-api/testdata/tls/ecdsa-p256.key   |    5 +
 .../testdata/tls/ecdsa-p384-cert.pem          |   12 +
 .../gateway-api/testdata/tls/ecdsa-p384.key   |    6 +
 .../gateway-api/testdata/tls/gen-certs.sh     |   31 +
 .../testdata/tls/invalid-key-type.key         |    3 +
 .../testdata/tls/malformed-cert.pem           |    3 +
 .../testdata/tls/malformed-ecdsa.key          |    3 +
 .../testdata/tls/malformed-encoding.pem       |    1 +
 .../testdata/tls/malformed-pkcs1.key          |    3 +
 .../testdata/tls/malformed-pkcs8.key          |    3 +
 .../gateway-api/testdata/tls/rsa-cert-san.pem |   19 +
 .../testdata/tls/rsa-cert-wildcard.pem        |   19 +
 .../gateway-api/testdata/tls/rsa-cert.pem     |   19 +
 .../testdata/tls/rsa-pkcs1-san.key            |   28 +
 .../testdata/tls/rsa-pkcs1-wildcard.key       |   28 +
 .../gateway-api/testdata/tls/rsa-pkcs1.key    |   28 +
 .../testdata/tls/rsa-pkcs8-san.key            |   28 +
 .../testdata/tls/rsa-pkcs8-wildcard.key       |   28 +
 .../gateway-api/testdata/tls/rsa-pkcs8.key    |   28 +
 .../tlsroute-attaching-to-gateway.in.yaml     |   32 +
 .../tlsroute-attaching-to-gateway.out.yaml    |  112 +
 .../testdata/tlsroute-multiple.in.yaml        |   48 +
 .../testdata/tlsroute-multiple.out.yaml       |  162 ++
 ...-attaching-to-gateway-with-no-mode.in.yaml |   29 +
 ...attaching-to-gateway-with-no-mode.out.yaml |   81 +
 ...ther-namespace-allowed-by-refgrant.in.yaml |   78 +
 ...her-namespace-allowed-by-refgrant.out.yaml |  113 +
 .../tlsroute-with-empty-hostname.in.yaml      |   31 +
 .../tlsroute-with-empty-hostname.out.yaml     |  111 +
 ...route-with-empty-listener-hostname.in.yaml |   33 +
 ...oute-with-empty-listener-hostname.out.yaml |  113 +
 ...ner-both-passthrough-and-cert-data.in.yaml |   44 +
 ...er-both-passthrough-and-cert-data.out.yaml |   86 +
 adapter/internal/operator/gateway-api/tls.go  |  149 ++
 .../internal/operator/gateway-api/tls_test.go |  236 ++
 .../operator/gateway-api/translator.go        |  292 +++
 .../gateway-api/translator/accesslog.go       |  277 ++
 .../gateway-api/translator/basicauth.go       |  149 ++
 .../gateway-api/translator/cluster.go         |  629 +++++
 .../operator/gateway-api/translator/cors.go   |  186 ++
 .../gateway-api/translator/extauth.go         |  300 +++
 .../operator/gateway-api/translator/fault.go  |  218 ++
 .../gateway-api/translator/httpfilters.go     |  243 ++
 .../gateway-api/translator/listener.go        |  691 +++++
 .../operator/gateway-api/translator/oidc.go   |  392 +++
 .../gateway-api/translator/proxy_protocol.go  |   70 +
 .../operator/gateway-api/translator/route.go  |  585 +++++
 .../gateway-api/translator/runner/runner.go   |  139 ++
 .../translator/runner/runner_test.go          |  199 ++
 .../gateway-api/translator/tcpkeepalive.go    |   82 +
 .../testdata/in/xds-ir/accesslog-invalid.yaml |   43 +
 .../testdata/in/xds-ir/accesslog.yaml         |   44 +
 .../testdata/in/xds-ir/basic-auth.yaml        |   22 +
 .../testdata/in/xds-ir/circuit-breaker.yaml   |   24 +
 .../testdata/in/xds-ir/client-timeout.yaml    |   22 +
 .../translator/testdata/in/xds-ir/cors.yaml   |   39 +
 .../translator/testdata/in/xds-ir/empty.yaml  |    0
 .../testdata/in/xds-ir/ext-auth.yaml          |   61 +
 .../testdata/in/xds-ir/fault-injection.yaml   |   83 +
 .../testdata/in/xds-ir/health-check.yaml      |  124 +
 .../in/xds-ir/http-route-direct-response.yaml |   22 +
 .../in/xds-ir/http-route-dns-cluster.yaml     |   26 +
 .../in/xds-ir/http-route-invalid.yaml         |   28 +
 .../testdata/in/xds-ir/http-route-mirror.yaml |   24 +
 .../xds-ir/http-route-multiple-matches.yaml   |   86 +
 .../xds-ir/http-route-multiple-mirrors.yaml   |   28 +
 .../in/xds-ir/http-route-partial-invalid.yaml |   46 +
 .../in/xds-ir/http-route-redirect.yaml        |   52 +
 .../testdata/in/xds-ir/http-route-regex.yaml  |   28 +
 .../in/xds-ir/http-route-request-headers.yaml |   38 +
 .../http-route-response-add-headers.yaml      |   35 +
 ...ttp-route-response-add-remove-headers.yaml |   38 +
 .../http-route-response-remove-headers.yaml   |   22 +
 ...tp-route-rewrite-root-path-url-prefix.yaml |   27 +
 .../http-route-rewrite-url-fullpath.yaml      |   24 +
 .../xds-ir/http-route-rewrite-url-host.yaml   |   28 +
 .../xds-ir/http-route-rewrite-url-prefix.yaml |   27 +
 .../in/xds-ir/http-route-timeout.yaml         |   47 +
 .../xds-ir/http-route-weighted-backend.yaml   |   31 +
 .../http-route-weighted-invalid-backend.yaml  |   21 +
 ...http-route-with-tls-system-truststore.yaml |   32 +
 ...p-route-with-tlsbundle-multiple-certs.yaml |   86 +
 .../in/xds-ir/http-route-with-tlsbundle.yaml  |   34 +
 .../testdata/in/xds-ir/http-route.yaml        |   28 +
 .../in/xds-ir/http1-preserve-case.yaml        |   40 +
 .../testdata/in/xds-ir/http1-trailers.yaml    |   20 +
 .../translator/testdata/in/xds-ir/http10.yaml |   21 +
 .../testdata/in/xds-ir/http2-route.yaml       |   30 +
 .../translator/testdata/in/xds-ir/http3.yaml  |   34 +
 .../jsonpatch-add-op-without-value.yaml       |   45 +
 .../in/xds-ir/jsonpatch-invalid-listener.yaml |   37 +
 .../in/xds-ir/jsonpatch-invalid-patch.yaml    |   26 +
 .../testdata/in/xds-ir/jsonpatch-invalid.yaml |   41 +
 .../in/xds-ir/jsonpatch-missing-resource.yaml |   26 +
 .../xds-ir/jsonpatch-move-op-with-value.yaml  |   48 +
 .../in/xds-ir/jwt-custom-extractor.yaml       |   36 +
 .../jwt-multi-route-multi-provider.yaml       |   72 +
 .../jwt-multi-route-single-provider.yaml      |   52 +
 .../testdata/in/xds-ir/jwt-ratelimit.yaml     |   72 +
 .../xds-ir/jwt-single-route-single-match.yaml |   28 +
 .../in/xds-ir/listener-proxy-protocol.yaml    |   32 +
 .../in/xds-ir/listener-tcp-keepalive.yaml     |   66 +
 .../testdata/in/xds-ir/load-balancer.yaml     |   75 +
 .../testdata/in/xds-ir/local-ratelimit.yaml   |   84 +
 .../in/xds-ir/metrics-virtual-host.yaml       |   21 +
 .../in/xds-ir/mixed-tls-jwt-authn.yaml        |   35 +
 ...ners-same-port-with-different-filters.yaml |  119 +
 .../xds-ir/multiple-listeners-same-port.yaml  |  116 +
 .../multiple-simple-tcp-route-same-port.yaml  |   56 +
 .../testdata/in/xds-ir/mutual-tls.yaml        |   34 +
 .../translator/testdata/in/xds-ir/oidc.yaml   |   58 +
 .../testdata/in/xds-ir/path-settings.yaml     |   18 +
 .../in/xds-ir/proxy-protocol-upstream.yaml    |   20 +
 .../in/xds-ir/retry-partial-invalid.yaml      |   54 +
 .../testdata/in/xds-ir/simple-tls.yaml        |   31 +
 .../in/xds-ir/suppress-envoy-headers.yaml     |   33 +
 .../testdata/in/xds-ir/tcp-route-complex.yaml |   18 +
 .../in/xds-ir/tcp-route-invalid-endpoint.yaml |   11 +
 .../testdata/in/xds-ir/tcp-route-invalid.yaml |   12 +
 .../testdata/in/xds-ir/tcp-route-simple.yaml  |   12 +
 .../in/xds-ir/tcp-route-tls-terminate.yaml    |   18 +
 .../in/xds-ir/tcp-route-weighted-backend.yaml |   29 +
 .../testdata/in/xds-ir/timeout.yaml           |   24 +
 .../in/xds-ir/tls-route-passthrough.yaml      |   30 +
 .../tls-with-ciphers-versions-alpn.yaml       |   50 +
 .../testdata/in/xds-ir/tracing-invalid.yaml   |   43 +
 .../testdata/in/xds-ir/tracing.yaml           |   43 +
 .../testdata/in/xds-ir/udp-route-invalid.yaml |   10 +
 .../testdata/in/xds-ir/udp-route.yaml         |   12 +
 .../in/xds-ir/upstream-tcpkeepalive.yaml      |   22 +
 .../out/xds-ir/accesslog.clusters.yaml        |   49 +
 .../out/xds-ir/accesslog.endpoints.yaml       |   12 +
 .../out/xds-ir/accesslog.listeners.yaml       |  143 ++
 .../testdata/out/xds-ir/accesslog.routes.yaml |   14 +
 .../out/xds-ir/basic-auth.clusters.yaml       |   17 +
 .../out/xds-ir/basic-auth.endpoints.yaml      |   12 +
 .../out/xds-ir/basic-auth.listeners.yaml      |   39 +
 .../out/xds-ir/basic-auth.routes.yaml         |   18 +
 .../out/xds-ir/circuit-breaker.clusters.yaml  |   27 +
 .../out/xds-ir/circuit-breaker.endpoints.yaml |   12 +
 .../out/xds-ir/circuit-breaker.listeners.yaml |   33 +
 .../out/xds-ir/circuit-breaker.routes.yaml    |   14 +
 .../out/xds-ir/client-timeout.clusters.yaml   |   17 +
 .../out/xds-ir/client-timeout.endpoints.yaml  |   12 +
 .../out/xds-ir/client-timeout.listeners.yaml  |   34 +
 .../out/xds-ir/client-timeout.routes.yaml     |   14 +
 .../testdata/out/xds-ir/cors.clusters.yaml    |   17 +
 .../testdata/out/xds-ir/cors.endpoints.yaml   |   12 +
 .../testdata/out/xds-ir/cors.listeners.yaml   |   36 +
 .../testdata/out/xds-ir/cors.routes.yaml      |   26 +
 .../testdata/out/xds-ir/empty.clusters.yaml   |    1 +
 .../testdata/out/xds-ir/empty.endpoints.yaml  |    1 +
 .../testdata/out/xds-ir/empty.listeners.yaml  |    1 +
 .../testdata/out/xds-ir/empty.routes.yaml     |    1 +
 .../out/xds-ir/ext-auth.clusters.yaml         |   73 +
 .../out/xds-ir/ext-auth.endpoints.yaml        |   48 +
 .../out/xds-ir/ext-auth.listeners.yaml        |   63 +
 .../testdata/out/xds-ir/ext-auth.routes.yaml  |   29 +
 .../out/xds-ir/fault-injection.clusters.yaml  |   85 +
 .../out/xds-ir/fault-injection.endpoints.yaml |   60 +
 .../out/xds-ir/fault-injection.listeners.yaml |   36 +
 .../out/xds-ir/fault-injection.routes.yaml    |   84 +
 .../out/xds-ir/health-check.clusters.yaml     |  141 ++
 .../out/xds-ir/health-check.endpoints.yaml    |   48 +
 .../out/xds-ir/health-check.listeners.yaml    |   33 +
 .../out/xds-ir/health-check.routes.yaml       |   35 +
 .../http-route-direct-response.clusters.yaml  |   17 +
 .../http-route-direct-response.endpoints.yaml |   12 +
 .../http-route-direct-response.listeners.yaml |   33 +
 .../http-route-direct-response.routes.yaml    |   14 +
 .../http-route-dns-cluster.clusters.yaml      |   33 +
 .../http-route-dns-cluster.endpoints.yaml     |    1 +
 .../http-route-dns-cluster.listeners.yaml     |   33 +
 .../xds-ir/http-route-dns-cluster.routes.yaml |   18 +
 .../xds-ir/http-route-mirror.clusters.yaml    |   17 +
 .../xds-ir/http-route-mirror.endpoints.yaml   |   12 +
 .../xds-ir/http-route-mirror.listeners.yaml   |   33 +
 .../out/xds-ir/http-route-mirror.routes.yaml  |   14 +
 .../http-route-multiple-matches.clusters.yaml |  119 +
 ...http-route-multiple-matches.endpoints.yaml |   84 +
 ...http-route-multiple-matches.listeners.yaml |   33 +
 .../http-route-multiple-matches.routes.yaml   |   80 +
 .../http-route-multiple-mirrors.clusters.yaml |   51 +
 ...http-route-multiple-mirrors.endpoints.yaml |   36 +
 ...http-route-multiple-mirrors.listeners.yaml |   33 +
 .../http-route-multiple-mirrors.routes.yaml   |   17 +
 .../http-route-partial-invalid.clusters.yaml  |   17 +
 .../http-route-partial-invalid.endpoints.yaml |   12 +
 .../http-route-partial-invalid.listeners.yaml |   33 +
 .../http-route-partial-invalid.routes.yaml    |   43 +
 .../xds-ir/http-route-redirect.clusters.yaml  |   17 +
 .../xds-ir/http-route-redirect.endpoints.yaml |   12 +
 .../xds-ir/http-route-redirect.listeners.yaml |   33 +
 .../xds-ir/http-route-redirect.routes.yaml    |   32 +
 .../out/xds-ir/http-route-regex.clusters.yaml |   17 +
 .../xds-ir/http-route-regex.endpoints.yaml    |   12 +
 .../xds-ir/http-route-regex.listeners.yaml    |   33 +
 .../out/xds-ir/http-route-regex.routes.yaml   |   25 +
 .../http-route-request-headers.clusters.yaml  |   17 +
 .../http-route-request-headers.endpoints.yaml |   12 +
 .../http-route-request-headers.listeners.yaml |   33 +
 .../http-route-request-headers.routes.yaml    |   36 +
 ...p-route-response-add-headers.clusters.yaml |   17 +
 ...-route-response-add-headers.endpoints.yaml |   12 +
 ...-route-response-add-headers.listeners.yaml |   33 +
 ...ttp-route-response-add-headers.routes.yaml |   33 +
 ...-response-add-remove-headers.clusters.yaml |   17 +
 ...response-add-remove-headers.endpoints.yaml |   12 +
 ...response-add-remove-headers.listeners.yaml |   33 +
 ...te-response-add-remove-headers.routes.yaml |   36 +
 ...oute-response-remove-headers.clusters.yaml |   17 +
 ...ute-response-remove-headers.endpoints.yaml |   12 +
 ...ute-response-remove-headers.listeners.yaml |   33 +
 ...-route-response-remove-headers.routes.yaml |   17 +
 ...rewrite-root-path-url-prefix.clusters.yaml |   17 +
 ...ewrite-root-path-url-prefix.endpoints.yaml |   12 +
 ...ewrite-root-path-url-prefix.listeners.yaml |   33 +
 ...e-rewrite-root-path-url-prefix.routes.yaml |   22 +
 ...p-route-rewrite-url-fullpath.clusters.yaml |   17 +
 ...-route-rewrite-url-fullpath.endpoints.yaml |   12 +
 ...-route-rewrite-url-fullpath.listeners.yaml |   33 +
 ...ttp-route-rewrite-url-fullpath.routes.yaml |   18 +
 .../http-route-rewrite-url-host.clusters.yaml |   17 +
 ...http-route-rewrite-url-host.endpoints.yaml |   12 +
 ...http-route-rewrite-url-host.listeners.yaml |   33 +
 .../http-route-rewrite-url-host.routes.yaml   |   21 +
 ...ttp-route-rewrite-url-prefix.clusters.yaml |   17 +
 ...tp-route-rewrite-url-prefix.endpoints.yaml |   12 +
 ...tp-route-rewrite-url-prefix.listeners.yaml |   33 +
 .../http-route-rewrite-url-prefix.routes.yaml |   19 +
 .../xds-ir/http-route-timeout.clusters.yaml   |   51 +
 .../xds-ir/http-route-timeout.endpoints.yaml  |   36 +
 .../xds-ir/http-route-timeout.listeners.yaml  |   33 +
 .../out/xds-ir/http-route-timeout.routes.yaml |   38 +
 .../http-route-weighted-backend.clusters.yaml |   17 +
 ...http-route-weighted-backend.endpoints.yaml |   42 +
 ...http-route-weighted-backend.listeners.yaml |   33 +
 .../http-route-weighted-backend.routes.yaml   |   14 +
 ...ute-weighted-invalid-backend.clusters.yaml |   17 +
 ...te-weighted-invalid-backend.endpoints.yaml |   12 +
 ...te-weighted-invalid-backend.listeners.yaml |   33 +
 ...route-weighted-invalid-backend.routes.yaml |   20 +
 ...oute-with-stripped-host-port.clusters.yaml |   13 +
 ...ute-with-stripped-host-port.listeners.yaml |   30 +
 ...e-with-tls-system-truststore.clusters.yaml |   30 +
 ...-with-tls-system-truststore.endpoints.yaml |   16 +
 ...-with-tls-system-truststore.listeners.yaml |   33 +
 ...ute-with-tls-system-truststore.routes.yaml |   14 +
 ...te-with-tls-system-truststore.secrets.yaml |    1 +
 ...ith-tlsbundle-multiple-certs.clusters.yaml |   94 +
 ...th-tlsbundle-multiple-certs.endpoints.yaml |   56 +
 ...th-tlsbundle-multiple-certs.listeners.yaml |   66 +
 ...-with-tlsbundle-multiple-certs.routes.yaml |   28 +
 ...with-tlsbundle-multiple-certs.secrets.yaml |   12 +
 .../http-route-with-tlsbundle.clusters.yaml   |   32 +
 .../http-route-with-tlsbundle.endpoints.yaml  |   16 +
 .../http-route-with-tlsbundle.listeners.yaml  |   33 +
 .../http-route-with-tlsbundle.routes.yaml     |   14 +
 .../http-route-with-tlsbundle.secrets.yaml    |    4 +
 .../out/xds-ir/http-route.clusters.yaml       |   17 +
 .../out/xds-ir/http-route.endpoints.yaml      |   12 +
 .../out/xds-ir/http-route.listeners.yaml      |   33 +
 .../out/xds-ir/http-route.routes.yaml         |   25 +
 .../xds-ir/http1-preserve-case.clusters.yaml  |   55 +
 .../xds-ir/http1-preserve-case.endpoints.yaml |   24 +
 .../xds-ir/http1-preserve-case.listeners.yaml |   79 +
 .../xds-ir/http1-preserve-case.routes.yaml    |   28 +
 .../out/xds-ir/http1-trailers.clusters.yaml   |   23 +
 .../out/xds-ir/http1-trailers.endpoints.yaml  |   12 +
 .../out/xds-ir/http1-trailers.listeners.yaml  |   35 +
 .../out/xds-ir/http1-trailers.routes.yaml     |   14 +
 .../testdata/out/xds-ir/http10.clusters.yaml  |   24 +
 .../testdata/out/xds-ir/http10.endpoints.yaml |   12 +
 .../testdata/out/xds-ir/http10.listeners.yaml |   36 +
 .../testdata/out/xds-ir/http10.routes.yaml    |   14 +
 .../out/xds-ir/http2-route.clusters.yaml      |   22 +
 .../out/xds-ir/http2-route.endpoints.yaml     |   12 +
 .../out/xds-ir/http2-route.listeners.yaml     |   41 +
 .../out/xds-ir/http2-route.routes.yaml        |   22 +
 .../testdata/out/xds-ir/http3.clusters.yaml   |   17 +
 .../testdata/out/xds-ir/http3.endpoints.yaml  |   12 +
 .../testdata/out/xds-ir/http3.listeners.yaml  |   99 +
 .../testdata/out/xds-ir/http3.routes.yaml     |   19 +
 .../testdata/out/xds-ir/http3.secrets.yaml    |    6 +
 ...onpatch-add-op-without-value.clusters.yaml |   17 +
 ...npatch-add-op-without-value.endpoints.yaml |   12 +
 ...d-op-without-value.envoypatchpolicies.yaml |    9 +
 ...npatch-add-op-without-value.listeners.yaml |   50 +
 ...jsonpatch-add-op-without-value.routes.yaml |   18 +
 .../jsonpatch-invalid-patch.clusters.yaml     |   17 +
 .../jsonpatch-invalid-patch.endpoints.yaml    |   12 +
 .../jsonpatch-invalid-patch.listeners.yaml    |   33 +
 .../jsonpatch-invalid-patch.routes.yaml       |   18 +
 .../jsonpatch-missing-resource.clusters.yaml  |   17 +
 .../jsonpatch-missing-resource.endpoints.yaml |   12 +
 ...h-missing-resource.envoypatchpolicies.yaml |   10 +
 .../jsonpatch-missing-resource.listeners.yaml |   33 +
 .../jsonpatch-missing-resource.routes.yaml    |   18 +
 ...jsonpatch-move-op-with-value.clusters.yaml |   17 +
 ...sonpatch-move-op-with-value.endpoints.yaml |   12 +
 ...move-op-with-value.envoypatchpolicies.yaml |    9 +
 ...sonpatch-move-op-with-value.listeners.yaml |   50 +
 .../jsonpatch-move-op-with-value.routes.yaml  |   18 +
 .../out/xds-ir/jsonpatch.clusters.yaml        |   17 +
 .../out/xds-ir/jsonpatch.endpoints.yaml       |   12 +
 .../xds-ir/jsonpatch.envoypatchpolicies.yaml  |    9 +
 .../out/xds-ir/jsonpatch.listeners.yaml       |   50 +
 .../testdata/out/xds-ir/jsonpatch.routes.yaml |   18 +
 .../out/xds-ir/jsonpatch.secrets.yaml         |   16 +
 .../listener-proxy-protocol.clusters.yaml     |   17 +
 .../listener-proxy-protocol.endpoints.yaml    |   12 +
 .../listener-proxy-protocol.listeners.yaml    |   60 +
 .../listener-proxy-protocol.routes.yaml       |   14 +
 .../listener-tcp-keepalive.clusters.yaml      |   68 +
 .../listener-tcp-keepalive.endpoints.yaml     |   48 +
 .../listener-tcp-keepalive.listeners.yaml     |  137 +
 .../xds-ir/listener-tcp-keepalive.routes.yaml |   28 +
 .../out/xds-ir/load-balancer.clusters.yaml    |  106 +
 .../out/xds-ir/load-balancer.endpoints.yaml   |   72 +
 .../out/xds-ir/load-balancer.listeners.yaml   |   33 +
 .../out/xds-ir/load-balancer.routes.yaml      |   52 +
 .../xds-ir/metrics-virtual-host.clusters.yaml |   17 +
 .../metrics-virtual-host.endpoints.yaml       |   12 +
 .../metrics-virtual-host.listeners.yaml       |   33 +
 .../xds-ir/metrics-virtual-host.routes.yaml   |   20 +
 .../xds-ir/mixed-tls-jwt-authn.clusters.yaml  |   45 +
 .../xds-ir/mixed-tls-jwt-authn.endpoints.yaml |   11 +
 .../xds-ir/mixed-tls-jwt-authn.listeners.yaml |   67 +
 .../xds-ir/mixed-tls-jwt-authn.routes.yaml    |   16 +
 .../xds-ir/mixed-tls-jwt-authn.secrets.yaml   |    6 +
 ...-port-with-different-filters.clusters.yaml |  104 +
 ...port-with-different-filters.endpoints.yaml |   48 +
 ...port-with-different-filters.listeners.yaml |  156 ++
 ...me-port-with-different-filters.routes.yaml |   54 +
 ...multiple-listeners-same-port.clusters.yaml |  102 +
 ...ultiple-listeners-same-port.endpoints.yaml |   72 +
 ...ultiple-listeners-same-port.listeners.yaml |  138 +
 .../multiple-listeners-same-port.routes.yaml  |   53 +
 .../multiple-listeners-same-port.secrets.yaml |   12 +
 ...e-simple-tcp-route-same-port.clusters.yaml |   85 +
 ...-simple-tcp-route-same-port.endpoints.yaml |   90 +
 ...-simple-tcp-route-same-port.listeners.yaml |   38 +
 ...ple-simple-tcp-route-same-port.routes.yaml |    1 +
 .../out/xds-ir/mutual-tls.clusters.yaml       |   17 +
 .../out/xds-ir/mutual-tls.endpoints.yaml      |   12 +
 .../out/xds-ir/mutual-tls.listeners.yaml      |   56 +
 .../out/xds-ir/mutual-tls.routes.yaml         |   14 +
 .../out/xds-ir/mutual-tls.secrets.yaml        |   16 +
 .../testdata/out/xds-ir/oidc.clusters.yaml    |  106 +
 .../testdata/out/xds-ir/oidc.endpoints.yaml   |   24 +
 .../testdata/out/xds-ir/oidc.listeners.yaml   |  115 +
 .../testdata/out/xds-ir/oidc.routes.yaml      |   29 +
 .../out/xds-ir/path-settings.clusters.yaml    |   17 +
 .../out/xds-ir/path-settings.endpoints.yaml   |   12 +
 .../out/xds-ir/path-settings.listeners.yaml   |   32 +
 .../out/xds-ir/path-settings.routes.yaml      |   14 +
 .../proxy-protocol-upstream.clusters.yaml     |   27 +
 .../proxy-protocol-upstream.endpoints.yaml    |   12 +
 .../proxy-protocol-upstream.listeners.yaml    |   33 +
 .../proxy-protocol-upstream.routes.yaml       |   14 +
 .../retry-partial-invalid.clusters.yaml       |   17 +
 .../retry-partial-invalid.endpoints.yaml      |   12 +
 .../retry-partial-invalid.listeners.yaml      |   33 +
 .../xds-ir/retry-partial-invalid.routes.yaml  |   53 +
 .../out/xds-ir/simple-tls.clusters.yaml       |   17 +
 .../out/xds-ir/simple-tls.endpoints.yaml      |   12 +
 .../out/xds-ir/simple-tls.listeners.yaml      |   50 +
 .../out/xds-ir/simple-tls.routes.yaml         |   14 +
 .../out/xds-ir/simple-tls.secrets.yaml        |   12 +
 .../suppress-envoy-headers.clusters.yaml      |   17 +
 .../suppress-envoy-headers.endpoints.yaml     |   12 +
 .../suppress-envoy-headers.listeners.yaml     |   56 +
 .../xds-ir/suppress-envoy-headers.routes.yaml |   14 +
 .../xds-ir/tcp-route-complex.clusters.yaml    |   17 +
 .../xds-ir/tcp-route-complex.endpoints.yaml   |   18 +
 .../xds-ir/tcp-route-complex.listeners.yaml   |   23 +
 .../out/xds-ir/tcp-route-complex.routes.yaml  |    1 +
 .../out/xds-ir/tcp-route-simple.clusters.yaml |   17 +
 .../xds-ir/tcp-route-simple.endpoints.yaml    |   18 +
 .../xds-ir/tcp-route-simple.listeners.yaml    |   14 +
 .../out/xds-ir/tcp-route-simple.routes.yaml   |    1 +
 .../tcp-route-tls-terminate.clusters.yaml     |   17 +
 .../tcp-route-tls-terminate.endpoints.yaml    |   18 +
 .../tcp-route-tls-terminate.listeners.yaml    |   27 +
 .../tcp-route-tls-terminate.routes.yaml       |    1 +
 .../tcp-route-weighted-backend.clusters.yaml  |   17 +
 .../tcp-route-weighted-backend.endpoints.yaml |   42 +
 .../tcp-route-weighted-backend.listeners.yaml |   23 +
 .../tcp-route-weighted-backend.routes.yaml    |    1 +
 .../testdata/out/xds-ir/timeout.clusters.yaml |   25 +
 .../out/xds-ir/timeout.endpoints.yaml         |   12 +
 .../out/xds-ir/timeout.listeners.yaml         |   33 +
 .../testdata/out/xds-ir/timeout.routes.yaml   |   14 +
 .../tls-route-passthrough.clusters.yaml       |   44 +
 .../tls-route-passthrough.endpoints.yaml      |   18 +
 .../tls-route-passthrough.listeners.yaml      |   42 +
 .../xds-ir/tls-route-passthrough.routes.yaml  |    1 +
 ...s-with-ciphers-versions-alpn.clusters.yaml |   17 +
 ...-with-ciphers-versions-alpn.endpoints.yaml |   12 +
 ...-with-ciphers-versions-alpn.listeners.yaml |   77 +
 ...tls-with-ciphers-versions-alpn.routes.yaml |   14 +
 .../testdata/out/xds-ir/tracing.clusters.yaml |   49 +
 .../out/xds-ir/tracing.endpoints.yaml         |   12 +
 .../out/xds-ir/tracing.listeners.yaml         |   62 +
 .../testdata/out/xds-ir/tracing.routes.yaml   |   14 +
 .../out/xds-ir/udp-route.clusters.yaml        |   17 +
 .../out/xds-ir/udp-route.endpoints.yaml       |   18 +
 .../out/xds-ir/udp-route.listeners.yaml       |   18 +
 .../testdata/out/xds-ir/udp-route.routes.yaml |    1 +
 .../upstream-tcpkeepalive.clusters.yaml       |   22 +
 .../upstream-tcpkeepalive.endpoints.yaml      |   12 +
 .../upstream-tcpkeepalive.listeners.yaml      |   33 +
 .../xds-ir/upstream-tcpkeepalive.routes.yaml  |   14 +
 .../gateway-api/translator/tracing.go         |  160 ++
 .../gateway-api/translator/translator.go      |  744 ++++++
 .../gateway-api/translator/translator_test.go |  556 +++++
 .../operator/gateway-api/translator/utils.go  |  135 +
 .../operator/gateway-api/types/tls_types.go   |  145 ++
 .../v1alpha1/accesslogging_types.go           |  136 +
 .../v1alpha1/envoyproxy_helpers.go            |  150 ++
 .../v1alpha1/envoyproxy_metric_types.go       |   88 +
 .../gateway-api/v1alpha1/envoyproxy_types.go  |  278 +++
 .../gateway-api/v1alpha1/groupversion_info.go |   42 +
 .../gateway-api/v1alpha1/keepalive_types.go   |   50 +
 .../v1alpha1/kubernetes_helpers.go            |  216 ++
 .../gateway-api/v1alpha1/retry_types.go       |  129 +
 .../gateway-api/v1alpha1/shared_types.go      |  447 ++++
 .../gateway-api/v1alpha1/timeout_types.go     |   80 +
 .../gateway-api/v1alpha1/tls_types.go         |  149 ++
 .../gateway-api/v1alpha1/tracing_types.go     |  125 +
 .../v1alpha1/zz_generated.deepcopy.go         | 1159 +++++++++
 .../internal/operator/gateway-api/validate.go |  916 +++++++
 .../operator/gateway-api/version/version.go   |   97 +
 .../gateway-api/xds/cache/snapshotcache.go    |  333 +++
 .../gateway-api/xds/filters/wellknown.go      |   64 +
 .../operator/gateway-api/xds/runner/runner.go |  187 ++
 .../gateway-api/xds/runner/runner_test.go     |  201 ++
 .../operator/gateway-api/xds/utils/utils.go   |   66 +
 .../gateway-api/zz_generated.deepcopy.go      |  213 ++
 .../operator/infrastructure/runner/runner.go  |  103 +
 adapter/internal/operator/message/types.go    |  106 +
 .../internal/operator/message/watchutil.go    |   71 +
 .../operator/message/watchutil_test.go        |   79 +
 .../provider-resources/runner/runner.go       |  249 ++
 .../provider/runner/provider_runner.go        |   69 +
 .../internal/operator/status/conditions.go    |  183 ++
 adapter/internal/operator/status/gateway.go   |  108 +
 .../internal/operator/status/gatewayclass.go  |   42 +
 adapter/internal/operator/status/status.go    |    3 +-
 .../synchronizer/zz_generated.deepcopy.go     |   25 +-
 .../internal/types/resourceversiontable.go    |  196 ++
 .../types/resourceversiontable_test.go        |  913 +++++++
 adapter/pkg/utils/file/file.go                |   44 +
 adapter/pkg/utils/misc/misc.go                |   73 +
 adapter/pkg/utils/misc/misc_test.go           |   50 +
 adapter/pkg/utils/protocov/protocov.go        |   55 +
 adapter/pkg/utils/regex/regex.go              |   36 +
 adapter/pkg/utils/regex/regex_test.go         |   51 +
 adapter/pkg/utils/stringutils/string_utils.go |   13 +
 .../utils/stringutils/string_utils_test.go    |   40 +
 adapter/revive.toml                           |    2 +-
 gateway/enforcer/Dockerfile                   |    2 +-
 .../apk/enforcer/config/EnvVarConfig.java     |    2 +-
 helm-charts/Chart.lock                        |    6 +-
 helm-charts/Chart.yaml                        |    2 +-
 .../certificates/envoy-certificate.yaml       |   43 +
 .../adapter/adapter-deployment.yaml           |   10 +-
 .../adapter-grpc-probe-script-conf.yaml       |    2 +-
 .../gateway-runtime-autoscaller.yaml          |   50 -
 .../gateway-runtime-deployment.yaml           |  476 ----
 .../gateway-runtime/gateway-service.yaml      |   41 -
 .../gateway-components/log-conf.yaml          |    2 +
 .../serviceAccount/apk-cluster-role.yaml      |   15 +-
 981 files changed, 98357 insertions(+), 655 deletions(-)
 create mode 100644 adapter/internal/operator/gateway-api/address.go
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/bootstrap_test.go
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml
 create mode 100644 adapter/internal/operator/gateway-api/contexts.go
 create mode 100644 adapter/internal/operator/gateway-api/crypto/certgen.go
 create mode 100644 adapter/internal/operator/gateway-api/crypto/certgen_test.go
 create mode 100644 adapter/internal/operator/gateway-api/envoy/shutdown_manager.go
 create mode 100644 adapter/internal/operator/gateway-api/filters.go
 create mode 100644 adapter/internal/operator/gateway-api/helpers.go
 create mode 100644 adapter/internal/operator/gateway-api/helpers_v1alpha2.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_client.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_resource.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/default.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/with-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/custom.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/default.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/with-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/default.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/with-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/clusterIP-custom-addresses.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/custom.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/default.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/override-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/patch-service.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/with-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_deployment_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_service_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/manager.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/infra.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/infra_test.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/protocol.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/xds.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/xds_test.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go
 create mode 100644 adapter/internal/operator/gateway-api/listener.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/predicates_test.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/status.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/store.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/store_test.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/scheme.go
 create mode 100644 adapter/internal/operator/gateway-api/resource.go
 create mode 100644 adapter/internal/operator/gateway-api/route.go
 create mode 100644 adapter/internal/operator/gateway-api/secrets.go
 create mode 100644 adapter/internal/operator/gateway-api/secrets_test.go
 create mode 100644 adapter/internal/operator/gateway-api/sort.go
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/disable-accesslog.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/disable-accesslog.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/.gitignore
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256-cert.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384-cert.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384.key
 create mode 100755 adapter/internal/operator/gateway-api/testdata/tls/gen-certs.sh
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/invalid-key-type.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/malformed-cert.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/malformed-ecdsa.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/malformed-encoding.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs1.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs8.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-san.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-wildcard.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-cert.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-san.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-wildcard.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-san.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-wildcard.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/tls.go
 create mode 100644 adapter/internal/operator/gateway-api/tls_test.go
 create mode 100644 adapter/internal/operator/gateway-api/translator.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/accesslog.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/basicauth.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/cluster.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/cors.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/extauth.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/fault.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/httpfilters.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/listener.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/oidc.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/proxy_protocol.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/route.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/runner/runner.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/runner/runner_test.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/tcpkeepalive.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/basic-auth.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/circuit-breaker.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/client-timeout.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/cors.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/empty.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/ext-auth.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/fault-injection.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/health-check.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-direct-response.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-dns-cluster.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-mirror.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-matches.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-mirrors.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-partial-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-redirect.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-regex.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-request-headers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-headers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-remove-headers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-remove-headers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-root-path-url-prefix.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-fullpath.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-host.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-prefix.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-timeout.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-backend.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-invalid-backend.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle-multiple-certs.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-preserve-case.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-trailers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http10.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http2-route.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http3.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-add-op-without-value.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-listener.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-patch.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-missing-resource.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-move-op-with-value.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-ratelimit.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-proxy-protocol.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-tcp-keepalive.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/load-balancer.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/local-ratelimit.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/metrics-virtual-host.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mixed-tls-jwt-authn.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port-with-different-filters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-simple-tcp-route-same-port.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mutual-tls.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/oidc.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/path-settings.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/proxy-protocol-upstream.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/retry-partial-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/simple-tls.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/suppress-envoy-headers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-complex.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid-endpoint.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-simple.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-tls-terminate.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-weighted-backend.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/timeout.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-route-passthrough.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-with-ciphers-versions-alpn.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/upstream-tcpkeepalive.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.routes.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.clusters.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.endpoints.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.listeners.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.routes.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.envoypatchpolicies.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.envoypatchpolicies.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.envoypatchpolicies.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.envoypatchpolicies.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.secrets.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.clusters.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.endpoints.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/tracing.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/translator.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/translator_test.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/utils.go
 create mode 100644 adapter/internal/operator/gateway-api/types/tls_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/accesslogging_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_metric_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/groupversion_info.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/keepalive_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/kubernetes_helpers.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/retry_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/timeout_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/tls_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/tracing_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/zz_generated.deepcopy.go
 create mode 100644 adapter/internal/operator/gateway-api/validate.go
 create mode 100644 adapter/internal/operator/gateway-api/version/version.go
 create mode 100644 adapter/internal/operator/gateway-api/xds/cache/snapshotcache.go
 create mode 100644 adapter/internal/operator/gateway-api/xds/filters/wellknown.go
 create mode 100644 adapter/internal/operator/gateway-api/xds/runner/runner.go
 create mode 100644 adapter/internal/operator/gateway-api/xds/runner/runner_test.go
 create mode 100644 adapter/internal/operator/gateway-api/xds/utils/utils.go
 create mode 100644 adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
 create mode 100644 adapter/internal/operator/infrastructure/runner/runner.go
 create mode 100644 adapter/internal/operator/message/types.go
 create mode 100644 adapter/internal/operator/message/watchutil.go
 create mode 100644 adapter/internal/operator/message/watchutil_test.go
 create mode 100644 adapter/internal/operator/provider-resources/runner/runner.go
 create mode 100644 adapter/internal/operator/provider/runner/provider_runner.go
 create mode 100644 adapter/internal/operator/status/conditions.go
 create mode 100644 adapter/internal/operator/status/gateway.go
 create mode 100644 adapter/internal/operator/status/gatewayclass.go
 create mode 100644 adapter/internal/types/resourceversiontable.go
 create mode 100644 adapter/internal/types/resourceversiontable_test.go
 create mode 100644 adapter/pkg/utils/file/file.go
 create mode 100644 adapter/pkg/utils/misc/misc.go
 create mode 100644 adapter/pkg/utils/misc/misc_test.go
 create mode 100644 adapter/pkg/utils/protocov/protocov.go
 create mode 100644 adapter/pkg/utils/regex/regex.go
 create mode 100644 adapter/pkg/utils/regex/regex_test.go
 create mode 100644 helm-charts/templates/cert-manager/certificates/envoy-certificate.yaml
 delete mode 100644 helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-autoscaller.yaml
 delete mode 100644 helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-deployment.yaml
 delete mode 100644 helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-service.yaml

diff --git a/adapter/config/default_config.go b/adapter/config/default_config.go
index ac8691917..51bb47424 100644
--- a/adapter/config/default_config.go
+++ b/adapter/config/default_config.go
@@ -31,6 +31,7 @@ var defaultConfig = &Config{
 		Operator: operator{
 			Namespaces: nil,
 		},
+		Namespace:   "apk",
 		Environment: "Default",
 		Metrics: Metrics{
 			Enabled: false,
@@ -48,6 +49,7 @@ var defaultConfig = &Config{
 		},
 	},
 	Envoy: envoy{
+		Namespace:         "apk",
 		ListenerCodecType: "AUTO",
 		// todo(amali) move connect timeout to crd
 		ClusterTimeoutInSeconds:          20,
diff --git a/adapter/config/types.go b/adapter/config/types.go
index 7b6c81740..329482ad9 100644
--- a/adapter/config/types.go
+++ b/adapter/config/types.go
@@ -93,6 +93,8 @@ type adapter struct {
 	Operator operator
 	// Environment of the Adapter
 	Environment string
+	// Namespace of the Adapter
+	Namespace string
 	// Metric represents configurations to expose/export go metrics
 	Metrics Metrics
 	// ControlPlane represents the connection configuration of ControlPlane
@@ -101,7 +103,8 @@ type adapter struct {
 
 // Envoy Listener Component related configurations.
 type envoy struct {
-
+	// Namespace of the envoyproxy gateway
+	Namespace string
 	// ListenerCodecType Default to AUTO where both http1 and http2 connections are handled
 	// It can be specifically set to either HTTP1 or HTTP2
 	ListenerCodecType string
diff --git a/adapter/go.mod b/adapter/go.mod
index a43b82e12..cebff372f 100644
--- a/adapter/go.mod
+++ b/adapter/go.mod
@@ -4,23 +4,29 @@ go 1.22
 
 require (
 	github.com/envoyproxy/go-control-plane v0.12.0
+	github.com/evanphx/json-patch v5.9.0+incompatible
 	github.com/fsnotify/fsnotify v1.7.0
-	github.com/golang/protobuf v1.5.3
+	github.com/golang/protobuf v1.5.4
+	github.com/google/go-cmp v0.6.0
 	github.com/google/uuid v1.6.0
 	github.com/onsi/ginkgo/v2 v2.14.0
 	github.com/onsi/gomega v1.30.0
 	github.com/pelletier/go-toml v1.9.5
-	github.com/prometheus/client_golang v1.18.0
-	github.com/sirupsen/logrus v1.9.0
+	github.com/prometheus/client_golang v1.19.0
+	github.com/sirupsen/logrus v1.9.3
+	github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7
 	github.com/wso2/apk/common-go-libs v0.0.0-20231208100153-24bee7b4bd81
 	golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb
-	google.golang.org/grpc v1.62.0
+	google.golang.org/grpc v1.62.1
 	google.golang.org/protobuf v1.33.0
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/api v0.29.2
+	k8s.io/apiextensions-apiserver v0.29.2
 	k8s.io/apimachinery v0.29.2
 	k8s.io/client-go v0.29.2
+	k8s.io/utils v0.0.0-20240102154912-e7106e64919e
 	sigs.k8s.io/controller-runtime v0.17.2
+	sigs.k8s.io/yaml v1.4.0
 )
 
 require (
@@ -28,11 +34,10 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
-	github.com/evanphx/json-patch/v5 v5.8.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
@@ -43,7 +48,6 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
@@ -51,15 +55,14 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
-	github.com/prometheus/client_model v0.5.0 // indirect
-	github.com/prometheus/common v0.45.0 // indirect
+	github.com/prometheus/client_model v0.6.0 // indirect
+	github.com/prometheus/common v0.50.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/shirou/gopsutil/v3 v3.24.2 // indirect
 	github.com/shoenig/go-m1cpu v0.1.6 // indirect
@@ -69,13 +72,13 @@ require (
 	github.com/vektah/gqlparser v1.3.1 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.26.0 // indirect
-	golang.org/x/net v0.21.0 // indirect
-	golang.org/x/oauth2 v0.16.0 // indirect
-	golang.org/x/term v0.17.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/net v0.22.0 // indirect
+	golang.org/x/oauth2 v0.18.0 // indirect
+	golang.org/x/term v0.18.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.16.1 // indirect
+	golang.org/x/tools v0.17.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 // indirect
@@ -83,14 +86,11 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.29.2 // indirect
 	k8s.io/component-base v0.29.2 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
-	k8s.io/utils v0.0.0-20240102154912-e7106e64919e // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
 )
 
 replace github.com/wso2/apk/adapter => ../adapter
@@ -98,9 +98,11 @@ replace github.com/wso2/apk/adapter => ../adapter
 replace github.com/wso2/apk/common-go-libs => ../common-go-libs
 
 require (
+	github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa
 	github.com/ghodss/yaml v1.0.0
-	github.com/stretchr/testify v1.8.4
-	golang.org/x/sys v0.17.0 // indirect
+	github.com/stretchr/testify v1.9.0
+	go.opentelemetry.io/proto/otlp v1.1.0
+	golang.org/x/sys v0.18.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	sigs.k8s.io/gateway-api v1.0.0
 )
diff --git a/adapter/go.sum b/adapter/go.sum
index d92a48c78..851996d0f 100644
--- a/adapter/go.sum
+++ b/adapter/go.sum
@@ -17,6 +17,8 @@ github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMn
 github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ=
 github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/datawire/dlib v1.3.0 h1:KkmyXU1kwm3oPBk1ypR70YbcOlEXWzEbx5RE0iRXTGk=
+github.com/datawire/dlib v1.3.0/go.mod h1:NiGDmetmbkBvtznpWSx6C0vA0s0LK9aHna3LJDqjruk=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -29,10 +31,10 @@ github.com/envoyproxy/go-control-plane v0.12.0 h1:4X+VP1GHd1Mhj6IB5mMeGbLCleqxjl
 github.com/envoyproxy/go-control-plane v0.12.0/go.mod h1:ZBTaoJ23lqITozF0M6G4/IragXCQKCnYbmlmtHvwRG0=
 github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A=
 github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
-github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
-github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch/v5 v5.8.0 h1:lRj6N9Nci7MvzrXuX6HFzU8XjmhPiXPlsKEy1u0KQro=
-github.com/evanphx/json-patch/v5 v5.8.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
+github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
+github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
+github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
@@ -59,8 +61,8 @@ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
 github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
@@ -95,8 +97,6 @@ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -117,12 +117,12 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
-github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
-github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
-github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
-github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
-github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU=
+github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k=
+github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
+github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
+github.com/prometheus/common v0.50.0 h1:YSZE6aa9+luNa2da6/Tik0q0A5AbR+U003TItK57CPQ=
+github.com/prometheus/common v0.50.0/go.mod h1:wHFBCEVWVmHMUpg7pYcOm2QUR/ocQdYSJVQJKnHc3xQ=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
 github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
@@ -136,8 +136,8 @@ github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFt
 github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
 github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
 github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -149,8 +149,13 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/telepresenceio/telepresence/rpc/v2 v2.6.8 h1:q5V85LBT9bA/c4YPa/kMvJGyKZDgBPJTftlAMqJx7j4=
+github.com/telepresenceio/telepresence/rpc/v2 v2.6.8/go.mod h1:VlgfRoXaW6Tl8IZbHmMWhITne8HY09/wOFtABHGj3ic=
+github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7 h1:GMw3nEaOVyi+tNiGko5kAeRtoiEIpXNHmISyZ7fpw14=
+github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7/go.mod h1:ihJ97e2gsd8GuzFF/I3B1qcik3XZLpXjumQifXi8Slg=
 github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
@@ -162,12 +167,14 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.opentelemetry.io/proto/otlp v1.1.0 h1:2Di21piLrCqJ3U3eXGCTPHE9R8Nh+0uglSnOyxikMeI=
+go.opentelemetry.io/proto/otlp v1.1.0/go.mod h1:GpBHCBWiqvVLDqmHZsoMM3C5ySeKTC7ej/RNTae6MdY=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -183,10 +190,10 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
-golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
+golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
+golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/oauth2 v0.18.0 h1:09qnuIAgzdx1XplqJvW6CQqMCtGZykZWcXzPMPUusvI=
+golang.org/x/oauth2 v0.18.0/go.mod h1:Wf7knwG0MPoWIMMBgFlEaSUDaKskp0dCfrlJRJXbBi8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -204,12 +211,13 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -224,8 +232,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.16.1 h1:TLyB3WofjdOEepBHAU20JdNC1Zbg87elYofWYAY5oZA=
-golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
+golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -240,8 +248,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80 h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 h1:AjyfHzEPEFp/NpvfN5g+KDla3EMojjhRVZc1i7cj+oM=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
-google.golang.org/grpc v1.62.0 h1:HQKZ/fa1bXkX1oFOvSjmZEUL8wLSaZTjCcLAlmZRtdk=
-google.golang.org/grpc v1.62.0/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
+google.golang.org/grpc v1.62.1 h1:B4n+nfKzOICUXMgyrNd19h/I9oH0L1pizfk1d4zSgTk=
+google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
diff --git a/adapter/internal/adapter/adapter.go b/adapter/internal/adapter/adapter.go
index 39f9c9be2..4b696d5e9 100644
--- a/adapter/internal/adapter/adapter.go
+++ b/adapter/internal/adapter/adapter.go
@@ -26,7 +26,12 @@ import (
 	xdsv3 "github.com/envoyproxy/go-control-plane/pkg/server/v3"
 	enforcerCallbacks "github.com/wso2/apk/adapter/internal/discovery/xds/enforcercallbacks"
 	routercb "github.com/wso2/apk/adapter/internal/discovery/xds/routercallbacks"
-	"github.com/wso2/apk/adapter/internal/operator"
+	xdstranslatorrunner "github.com/wso2/apk/adapter/internal/operator/gateway-api/translator/runner"
+	xdsserverrunner "github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/runner"
+	infrarunner "github.com/wso2/apk/adapter/internal/operator/infrastructure/runner"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/operator/provider-resources/runner"
+	providerrunner "github.com/wso2/apk/adapter/internal/operator/provider/runner"
 	apiservice "github.com/wso2/apk/adapter/pkg/discovery/api/wso2/discovery/service/api"
 	configservice "github.com/wso2/apk/adapter/pkg/discovery/api/wso2/discovery/service/config"
 	subscriptionservice "github.com/wso2/apk/adapter/pkg/discovery/api/wso2/discovery/service/subscription"
@@ -50,6 +55,7 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/keepalive"
+	ctrl "sigs.k8s.io/controller-runtime"
 )
 
 var (
@@ -70,7 +76,7 @@ const (
 func init() {
 	flag.BoolVar(&debug, "debug", true, "Use debug logging")
 	flag.BoolVar(&onlyLogging, "onlyLogging", false, "Only demo AccessLogging Service")
-	flag.UintVar(&port, "port", 18000, "Management server port")
+	flag.UintVar(&port, "port", 18001, "Management server port")
 	flag.UintVar(&alsPort, "als", 18090, "Accesslog server port")
 	flag.StringVar(&mode, "ads", ads, "Management server type (ads, xds, rest)")
 }
@@ -132,6 +138,72 @@ func runManagementServer(conf *config.Config, server xdsv3.Server, enforcerServe
 
 }
 
+func SetupRunners(conf *config.Config) {
+	ctx := ctrl.SetupSignalHandler()
+	// start the operator
+	pResources := new(message.ProviderResources)
+	// Start the Provider Service
+	// It fetches the resources from the configured provider type
+	// and publishes it
+	// It also subscribes to status resources and once it receives
+	// a status resource back, it writes it out.
+	providerRunner := providerrunner.New(&providerrunner.Config{
+		ProviderResources: pResources,
+	})
+	if err := providerRunner.Start(ctx); err != nil {
+		logger.LoggerAPKOperator.Error("Error while starting provider service", err)
+	}
+
+	xdsIR := new(message.XdsIR)
+	infraIR := new(message.InfraIR)
+	// Start the GatewayAPI Translator Runner
+	// It subscribes to the provider resources, translates it to xDS IR
+	// and infra IR resources and publishes them.
+	gwRunner := runner.New(&runner.Config{
+		ProviderResources: pResources,
+		XdsIR:             xdsIR,
+		InfraIR:           infraIR,
+	})
+	if err := gwRunner.Start(ctx); err != nil {
+		logger.LoggerAPKOperator.Error("Error while starting translation service", err)
+	}
+
+	xds := new(message.Xds)
+	// Start the Xds Translator Service
+	// It subscribes to the xdsIR, translates it into xds Resources and publishes it.
+	xdsTranslatorRunner := xdstranslatorrunner.New(&xdstranslatorrunner.Config{
+		// Server:            *cfg,
+		XdsIR: xdsIR,
+		Xds:   xds,
+		// ExtensionManager:  extMgr,
+		ProviderResources: pResources,
+	})
+	if err := xdsTranslatorRunner.Start(ctx); err != nil {
+		logger.LoggerAPKOperator.Error("Error while starting xds translator service", err)
+	}
+
+	// Start the Infra Manager Runner
+	// It subscribes to the infraIR, translates it into Envoy Proxy infrastructure
+	// resources such as K8s deployment and services.
+	infraRunner := infrarunner.New(&infrarunner.Config{
+		InfraIR: infraIR,
+	})
+	if err := infraRunner.Start(ctx); err != nil {
+		logger.LoggerAPKOperator.Error("Error while starting infrastructure service", err)
+	}
+
+	// Start the xDS Server
+	// It subscribes to the xds Resources and configures the remote Envoy Proxy
+	// via the xDS Protocol.
+	xdsServerRunner := xdsserverrunner.New(&xdsserverrunner.Config{
+		// Server: *cfg,
+		Xds: xds,
+	})
+	if err := xdsServerRunner.Start(ctx); err != nil {
+		logger.LoggerAPKOperator.Error("Error while starting xds service", err)
+	}
+}
+
 // Run starts the XDS server and Rest API server.
 func Run(conf *config.Config) {
 	sig := make(chan os.Signal, 2)
@@ -180,7 +252,8 @@ func Run(conf *config.Config) {
 	// Set enforcer startup configs
 	xds.UpdateEnforcerConfig(conf)
 
-	go operator.InitOperator(conf.Adapter.Metrics)
+	// go operator.InitOperator(conf.Adapter.Metrics)
+	SetupRunners(conf)
 
 OUTER:
 	for {
diff --git a/adapter/internal/oasparser/envoyconf/constants.go b/adapter/internal/oasparser/envoyconf/constants.go
index 1798d6d19..ca09e482b 100644
--- a/adapter/internal/oasparser/envoyconf/constants.go
+++ b/adapter/internal/oasparser/envoyconf/constants.go
@@ -22,7 +22,6 @@ const (
 	accessLoggerClusterName string = "access-logger"
 	grpcAccessLogLogName    string = "apk_access_logs"
 	tracingClusterName      string = "wso2_apk_trace"
-	extAuthzHTTPCluster     string = "ext_authz_http_cluster"
 	rateLimitClusterName    string = "ratelimit"
 )
 
diff --git a/adapter/internal/operator/constants/constants.go b/adapter/internal/operator/constants/constants.go
index 872c3491e..c7deda3fb 100644
--- a/adapter/internal/operator/constants/constants.go
+++ b/adapter/internal/operator/constants/constants.go
@@ -21,6 +21,7 @@ package constants
 const (
 	APIController          string = "APIController"
 	GatewayController      string = "GatewayController"
+	GatewayControllerNew   string = "GatewayControllerNew"
 	ApplicationController  string = "ApplicationController"
 	SubscriptionController string = "SubscriptionController"
 	TokenIssuerController  string = "TokenIssuerController"
@@ -39,8 +40,10 @@ const (
 	OperatorPodNamespaceDefaultValue string = "default"
 )
 
+// todo(amali) move to translators
 // CRD Kinds
 const (
+	GroupName          = "dp.wso2.com"
 	KindAuthentication = "Authentication"
 	KindAPI            = "API"
 	KindService        = "Service"
diff --git a/adapter/internal/operator/controllers/dp/tokenissuer_controller.go b/adapter/internal/operator/controllers/dp/tokenissuer_controller.go
index 7f46e52ef..75517b4bd 100644
--- a/adapter/internal/operator/controllers/dp/tokenissuer_controller.go
+++ b/adapter/internal/operator/controllers/dp/tokenissuer_controller.go
@@ -30,6 +30,8 @@ import (
 	"github.com/wso2/apk/adapter/pkg/logging"
 	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
 	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -38,10 +40,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
-	"sigs.k8s.io/controller-runtime/pkg/source"
-	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-	"k8s.io/apimachinery/pkg/fields"
+	"sigs.k8s.io/controller-runtime/pkg/source"
 )
 
 const (
@@ -139,7 +139,7 @@ func (r *TokenssuerReconciler) populateTokenReconcileRequestsForConfigMap(ctx co
 	})
 	requests := []reconcile.Request{}
 	if err == nil && len(tokenIssuerList.Items) > 0 {
-		
+
 		for _, tokenIssuer := range tokenIssuerList.Items {
 			req := reconcile.Request{
 				NamespacedName: types.NamespacedName{
@@ -168,7 +168,7 @@ func (r *TokenssuerReconciler) populateTokenReconcileRequestsForSecret(ctx conte
 	})
 	requests := []reconcile.Request{}
 	if err == nil && len(tokenIssuerList.Items) > 0 {
-		
+
 		for _, tokenIssuer := range tokenIssuerList.Items {
 			req := reconcile.Request{
 				NamespacedName: types.NamespacedName{
diff --git a/adapter/internal/operator/gateway-api/address.go b/adapter/internal/operator/gateway-api/address.go
new file mode 100644
index 000000000..3342bdc52
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/address.go
@@ -0,0 +1,49 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+var _ AddressesTranslator = (*Translator)(nil)
+
+type AddressesTranslator interface {
+	ProcessAddresses(gateways []*GatewayContext, infraIR InfraIRMap)
+}
+
+func (t *Translator) ProcessAddresses(gateways []*GatewayContext, infraIR InfraIRMap) {
+	for _, gateway := range gateways {
+		// Infra IR already exist
+		irKey := t.getIRKey(gateway.Gateway)
+		gwInfraIR := infraIR[irKey]
+
+		var ips []string
+		for _, gwadr := range gateway.Spec.Addresses {
+			if *gwadr.Type == v1.IPAddressType {
+				ips = append(ips, gwadr.Value)
+			}
+		}
+		gwInfraIR.Proxy.Addresses = ips
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
new file mode 100644
index 000000000..9c132361d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
@@ -0,0 +1,226 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package bootstrap
+
+import (
+	// Register embed
+	_ "embed"
+	"fmt"
+	"strings"
+	"text/template"
+
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	"github.com/wso2/apk/adapter/pkg/utils/regex"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+const (
+	// envoyCfgFileName is the name of the Envoy configuration file.
+	envoyCfgFileName = "bootstrap.yaml"
+	// envoyGatewayXdsServerHost is the DNS name of the Xds Server within Envoy Gateway.
+	// It defaults to the Envoy Gateway Kubernetes service.
+	envoyGatewayXdsServerHost = "envoy-gateway"
+	// EnvoyAdminAddress is the listening address of the envoy admin interface.
+	EnvoyAdminAddress = "0.0.0.0"
+	// EnvoyAdminPort is the port used to expose admin interface.
+	EnvoyAdminPort = 19000
+	// envoyAdminAccessLogPath is the path used to expose admin access log.
+	envoyAdminAccessLogPath = "/dev/null"
+
+	// DefaultXdsServerPort is the default listening port of the xds-server.
+	DefaultXdsServerPort = 18000
+
+	envoyReadinessAddress = "0.0.0.0"
+	EnvoyReadinessPort    = 19001
+	EnvoyReadinessPath    = "/ready"
+)
+
+//go:embed bootstrap.yaml.tpl
+var bootstrapTmplStr string
+
+var bootstrapTmpl = template.Must(template.New(envoyCfgFileName).Parse(bootstrapTmplStr))
+
+// envoyBootstrap defines the envoy Bootstrap configuration.
+type bootstrapConfig struct {
+	// parameters defines configurable bootstrap configuration parameters.
+	parameters bootstrapParameters
+	// rendered is the rendered bootstrap configuration.
+	rendered string
+}
+
+// envoyBootstrap defines the envoy Bootstrap configuration.
+type bootstrapParameters struct {
+	// XdsServer defines the configuration of the XDS server.
+	XdsServer xdsServerParameters
+	// AdminServer defines the configuration of the Envoy admin interface.
+	AdminServer adminServerParameters
+	// ReadyServer defines the configuration for health check ready listener
+	ReadyServer readyServerParameters
+	// EnablePrometheus defines whether to enable metrics endpoint for prometheus.
+	EnablePrometheus bool
+	// OtelMetricSinks defines the configuration of the OpenTelemetry sinks.
+	OtelMetricSinks []metricSink
+	// EnableStatConfig defines whether to to customize the Envoy proxy stats.
+	EnableStatConfig bool
+	// StatsMatcher is to control creation of custom Envoy stats with prefix,
+	// suffix, and regex expressions match on the name of the stats.
+	StatsMatcher *StatsMatcherParameters
+}
+
+type xdsServerParameters struct {
+	// Address is the address of the XDS Server that Envoy is managed by.
+	Address string
+	// Port is the port of the XDS Server that Envoy is managed by.
+	Port int32
+}
+
+type metricSink struct {
+	// Address is the address of the XDS Server that Envoy is managed by.
+	Address string
+	// Port is the port of the XDS Server that Envoy is managed by.
+	Port int32
+}
+
+type adminServerParameters struct {
+	// Address is the address of the Envoy admin interface.
+	Address string
+	// Port is the port of the Envoy admin interface.
+	Port int32
+	// AccessLogPath is the path of the Envoy admin access log.
+	AccessLogPath string
+}
+
+type readyServerParameters struct {
+	// Address is the address of the Envoy readiness probe
+	Address string
+	// Port is the port of envoy readiness probe
+	Port int32
+	// ReadinessPath is the path for the envoy readiness probe
+	ReadinessPath string
+}
+
+type StatsMatcherParameters struct {
+	Exacts             []string
+	Prefixs            []string
+	Suffixs            []string
+	RegularExpressions []string
+}
+
+// render the stringified bootstrap config in yaml format.
+func (b *bootstrapConfig) render() error {
+	buf := new(strings.Builder)
+	if err := bootstrapTmpl.Execute(buf, b.parameters); err != nil {
+		return fmt.Errorf("failed to render bootstrap config: %w", err)
+	}
+	b.rendered = buf.String()
+
+	return nil
+}
+
+// GetRenderedBootstrapConfig renders the bootstrap YAML string
+func GetRenderedBootstrapConfig(proxyMetrics *egv1a1.ProxyMetrics) (string, error) {
+	var (
+		enablePrometheus = true
+		metricSinks      []metricSink
+		StatsMatcher     StatsMatcherParameters
+	)
+
+	if proxyMetrics != nil {
+		if proxyMetrics.Prometheus != nil {
+			enablePrometheus = !proxyMetrics.Prometheus.Disable
+		}
+
+		addresses := sets.NewString()
+		for _, sink := range proxyMetrics.Sinks {
+			if sink.OpenTelemetry == nil {
+				continue
+			}
+
+			// skip duplicate sinks
+			addr := fmt.Sprintf("%s:%d", sink.OpenTelemetry.Host, sink.OpenTelemetry.Port)
+			if addresses.Has(addr) {
+				continue
+			}
+			addresses.Insert(addr)
+
+			metricSinks = append(metricSinks, metricSink{
+				Address: sink.OpenTelemetry.Host,
+				Port:    sink.OpenTelemetry.Port,
+			})
+		}
+
+		if proxyMetrics.Matches != nil {
+			// Add custom envoy proxy stats
+			for _, match := range proxyMetrics.Matches {
+				// matchType default to exact
+				matchType := egv1a1.StringMatchExact
+				if match.Type != nil {
+					matchType = *match.Type
+				}
+				switch matchType {
+				case egv1a1.StringMatchExact:
+					StatsMatcher.Exacts = append(StatsMatcher.Exacts, match.Value)
+				case egv1a1.StringMatchPrefix:
+					StatsMatcher.Prefixs = append(StatsMatcher.Prefixs, match.Value)
+				case egv1a1.StringMatchSuffix:
+					StatsMatcher.Suffixs = append(StatsMatcher.Suffixs, match.Value)
+				case egv1a1.StringMatchRegularExpression:
+					if err := regex.Validate(match.Value); err != nil {
+						return "", err
+					}
+					StatsMatcher.RegularExpressions = append(StatsMatcher.RegularExpressions, match.Value)
+				}
+			}
+		}
+	}
+
+	cfg := &bootstrapConfig{
+		parameters: bootstrapParameters{
+			XdsServer: xdsServerParameters{
+				Address: envoyGatewayXdsServerHost,
+				Port:    DefaultXdsServerPort,
+			},
+			AdminServer: adminServerParameters{
+				Address:       EnvoyAdminAddress,
+				Port:          EnvoyAdminPort,
+				AccessLogPath: envoyAdminAccessLogPath,
+			},
+			ReadyServer: readyServerParameters{
+				Address:       envoyReadinessAddress,
+				Port:          EnvoyReadinessPort,
+				ReadinessPath: EnvoyReadinessPath,
+			},
+			EnablePrometheus: enablePrometheus,
+			OtelMetricSinks:  metricSinks,
+		},
+	}
+	if proxyMetrics != nil && proxyMetrics.Matches != nil {
+		cfg.parameters.StatsMatcher = &StatsMatcher
+	}
+
+	if err := cfg.render(); err != nil {
+		return "", err
+	}
+
+	return cfg.rendered, nil
+}
diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
new file mode 100644
index 000000000..bad77c930
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
@@ -0,0 +1,191 @@
+admin:
+  access_log:
+  - name: envoy.access_loggers.file
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: {{ .AdminServer.AccessLogPath }}
+  address:
+    socket_address:
+      address: {{ .AdminServer.Address }}
+      port_value: {{ .AdminServer.Port }}
+{{- if .StatsMatcher  }}
+stats_config:
+  stats_matcher:
+    inclusion_list:
+      patterns:
+      {{- range $_, $item := .StatsMatcher.Exacts }}
+      - exact: {{$item}}
+      {{- end}}
+      {{- range $_, $item := .StatsMatcher.Prefixs }}
+      - prefix: {{$item}}
+      {{- end}}
+      {{- range $_, $item := .StatsMatcher.Suffixs }}
+      - suffix: {{$item}}
+      {{- end}}
+      {{- range $_, $item := .StatsMatcher.RegularExpressions }}
+      - safe_regex:
+          google_re2: {}
+          regex: {{js $item}}
+      {{- end}}
+{{- end }}
+layered_runtime:
+  layers:
+  - name: global_config
+    static_layer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+dynamic_resources:
+  ads_config:
+    api_type: DELTA_GRPC
+    transport_api_version: V3
+    grpc_services:
+    - envoy_grpc:
+        cluster_name: xds_cluster
+    set_node_on_first_message_only: true
+  lds_config:
+    ads: {}
+    resource_api_version: V3
+  cds_config:
+    ads: {}
+    resource_api_version: V3
+{{- if .OtelMetricSinks }}
+stats_sinks:
+{{- range $idx, $sink := .OtelMetricSinks }}
+- name: "envoy.stat_sinks.open_telemetry"
+  typed_config:
+    "@type": type.googleapis.com/envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig
+    grpc_service:
+      envoy_grpc:
+        cluster_name: otel_metric_sink_{{ $idx }}
+{{- end }}
+{{- end }}
+static_resources:
+  listeners:
+  - name: envoy-gateway-proxy-ready-{{ .ReadyServer.Address }}-{{ .ReadyServer.Port }}
+    address:
+      socket_address:
+        address: {{ .ReadyServer.Address }}
+        port_value: {{ .ReadyServer.Port }}
+        protocol: TCP
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: eg-ready-http
+          route_config:
+            name: local_route
+          http_filters:
+          - name: envoy.filters.http.health_check
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              pass_through_mode: false
+              headers:
+              - name: ":path"
+                string_match:
+                  exact: {{ .ReadyServer.ReadinessPath }}
+          - name: envoy.filters.http.ext_authz
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+              clear_route_cache: true
+              include_peer_certificate: true
+              transport_api_version: 2
+              grpc_service: 
+                  envoy_grpc: 
+                    cluster_name: ext-authz
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  {{- range $idx, $sink := .OtelMetricSinks }}
+  - name: otel_metric_sink_{{ $idx }}
+    connect_timeout: 0.250s
+    type: STRICT_DNS
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options: {}
+    lb_policy: ROUND_ROBIN
+    load_assignment:
+      cluster_name: otel_metric_sink_{{ $idx }}
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: {{ $sink.Address }}
+                port_value: {{ $sink.Port }}
+  {{- end }}
+  - connect_timeout: 10s
+    load_assignment:
+      cluster_name: xds_cluster
+      endpoints:
+      - load_balancing_weight: 1
+        lb_endpoints:
+        - load_balancing_weight: 1
+          endpoint:
+            address:
+              socket_address:
+                address: apk-test-wso2-apk-adapter-service.apk.svc
+                port_value: {{ .XdsServer.Port }}
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options:
+            connection_keepalive:
+              interval: 30s
+              timeout: 5s
+    name: xds_cluster
+    type: STRICT_DNS
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_maximum_protocol_version: TLSv1_3
+          tls_certificates:
+            private_key:
+              filename: '/home/wso2/security/keystore/router.key'
+            certificate_chain:
+              filename: '/home/wso2/security/keystore/router.crt'
+          validation_context:
+            trusted_ca:
+              filename: '/home/wso2/security/truststore/adapter.crt'
+  - name: ext-authz
+    type: STRICT_DNS
+    connect_timeout: 20s
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicit_http_config:
+          http2_protocol_options: {}
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_minimum_protocol_version: TLSv1_2
+            tls_maximum_protocol_version: TLSv1_2
+          tls_certificates:
+            private_key:
+              filename: "/home/wso2/security/keystore/router.key"
+            certificate_chain:
+              filename: "/home/wso2/security/keystore/router.crt"
+          validation_context:
+            trusted_ca:
+              filename: "/home/wso2/security/truststore/enforcer.crt"
+    load_assignment:
+      cluster_name: ext-authz
+      endpoints:
+        - lb_endpoints:
+            - endpoint:
+                address:
+                  socket_address:
+                    address: enforcer
+                    port_value: 8081
+  
\ No newline at end of file
diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap_test.go b/adapter/internal/operator/gateway-api/bootstrap/bootstrap_test.go
new file mode 100644
index 000000000..ae4118529
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap_test.go
@@ -0,0 +1,128 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package bootstrap
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path"
+)
+
+var (
+	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
+)
+
+// func TestGetRenderedBootstrapConfig(t *testing.T) {
+// 	cases := []struct {
+// 		name         string
+// 		proxyMetrics *egv1a1.ProxyMetrics
+// 	}{
+// 		{
+// 			name: "disable-prometheus",
+// 			proxyMetrics: &egv1a1.ProxyMetrics{
+// 				Prometheus: &egv1a1.ProxyPrometheusProvider{
+// 					Disable: true,
+// 				},
+// 			},
+// 		},
+// 		{
+// 			name: "enable-prometheus",
+// 			proxyMetrics: &egv1a1.ProxyMetrics{
+// 				Prometheus: &egv1a1.ProxyPrometheusProvider{},
+// 			},
+// 		},
+// 		{
+// 			name: "otel-metrics",
+// 			proxyMetrics: &egv1a1.ProxyMetrics{
+// 				Prometheus: &egv1a1.ProxyPrometheusProvider{
+// 					Disable: true,
+// 				},
+// 				Sinks: []egv1a1.ProxyMetricSink{
+// 					{
+// 						Type: egv1a1.MetricSinkTypeOpenTelemetry,
+// 						OpenTelemetry: &egv1a1.ProxyOpenTelemetrySink{
+// 							Host: "otel-collector.monitoring.svc",
+// 							Port: 4317,
+// 						},
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			name: "custom-stats-matcher",
+// 			proxyMetrics: &egv1a1.ProxyMetrics{
+// 				Matches: []egv1a1.StringMatch{
+// 					{
+// 						Type:  ptr.To(egv1a1.StringMatchExact),
+// 						Value: "http.foo.bar.cluster.upstream_rq",
+// 					},
+// 					{
+// 						Type:  ptr.To(egv1a1.StringMatchPrefix),
+// 						Value: "http",
+// 					},
+// 					{
+// 						Type:  ptr.To(egv1a1.StringMatchSuffix),
+// 						Value: "upstream_rq",
+// 					},
+// 					{
+// 						Type:  ptr.To(egv1a1.StringMatchRegularExpression),
+// 						Value: "virtual.*",
+// 					},
+// 					{
+// 						Type:  ptr.To(egv1a1.StringMatchPrefix),
+// 						Value: "cluster",
+// 					},
+// 				},
+// 			},
+// 		},
+// 	}
+
+// 	for _, tc := range cases {
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			got, err := GetRenderedBootstrapConfig(tc.proxyMetrics)
+// 			require.NoError(t, err)
+
+// 			if *overrideTestData {
+// 				// nolint:gosec
+// 				err = os.WriteFile(path.Join("testdata", "render", fmt.Sprintf("%s.yaml", tc.name)), []byte(got), 0644)
+// 				require.NoError(t, err)
+// 				return
+// 			}
+
+// 			expected, err := readTestData(tc.name)
+// 			require.NoError(t, err)
+// 			assert.Equal(t, expected, got)
+// 		})
+// 	}
+// }
+
+func readTestData(caseName string) (string, error) {
+	filename := path.Join("testdata", "render", fmt.Sprintf("%s.yaml", caseName))
+
+	b, err := os.ReadFile(filename)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.in.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.in.yaml
new file mode 100644
index 000000000..3a18cfed3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.in.yaml
@@ -0,0 +1,13 @@
+admin:
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 20000
+layered_runtime:
+  layers:
+  - name: runtime-0
+    rtds_layer:
+      rtds_config:
+        ads: {}
+        resource_api_version: V3
+      name: runtime-0
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml
new file mode 100644
index 000000000..528105b3b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml
@@ -0,0 +1,118 @@
+admin:
+  accessLog:
+  - name: envoy.access_loggers.file
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 20000
+dynamicResources:
+  adsConfig:
+    apiType: DELTA_GRPC
+    grpcServices:
+    - envoyGrpc:
+        clusterName: xds_cluster
+    setNodeOnFirstMessageOnly: true
+    transportApiVersion: V3
+  cdsConfig:
+    ads: {}
+    resourceApiVersion: V3
+  ldsConfig:
+    ads: {}
+    resourceApiVersion: V3
+layeredRuntime:
+  layers:
+  - name: global_config
+    staticLayer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+  - name: runtime-0
+    rtdsLayer:
+      name: runtime-0
+      rtdsConfig:
+        ads: {}
+        resourceApiVersion: V3
+staticResources:
+  clusters:
+  # - connectTimeout: 0.250s
+  #   loadAssignment:
+  #     clusterName: prometheus_stats
+  #     endpoints:
+  #     - lbEndpoints:
+  #       - endpoint:
+  #           address:
+  #             socketAddress:
+  #               address: 0.0.0.0
+  #               portValue: 19000
+  #   name: prometheus_stats
+  #   type: STATIC
+  - connectTimeout: 10s
+    loadAssignment:
+      clusterName: xds_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: envoy-gateway
+                portValue: 18000
+          loadBalancingWeight: 1
+        loadBalancingWeight: 1
+    name: xds_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          tlsCertificateSdsSecretConfigs:
+          - name: xds_certificate
+            sdsConfig:
+              pathConfigSource:
+                path: /sds/xds-certificate.json
+              resourceApiVersion: V3
+          tlsParams:
+            tlsMaximumProtocolVersion: TLSv1_3
+          validationContextSdsSecretConfig:
+            name: xds_trusted_ca
+            sdsConfig:
+              pathConfigSource:
+                path: /sds/xds-trusted-ca.json
+              resourceApiVersion: V3
+    type: STRICT_DNS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions:
+            connectionKeepalive:
+              interval: 30s
+              timeout: 5s
+  listeners:
+  - address:
+      socketAddress:
+        address: 0.0.0.0
+        portValue: 19001
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          httpFilters:
+          - name: envoy.filters.http.health_check
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              headers:
+              - name: :path
+                stringMatch:
+                  exact: /ready
+              passThroughMode: false
+          - name: envoy.filters.http.router
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+          routeConfig:
+            name: local_route
+          statPrefix: eg-ready-http
+    name: envoy-gateway-proxy-ready-0.0.0.0-19001
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.in.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.in.yaml
new file mode 100644
index 000000000..8b4f9363f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.in.yaml
@@ -0,0 +1,34 @@
+stats_sinks:
+  - name: envoy.stat_sinks.metrics_service
+    typed_config:
+      "@type": type.googleapis.com/envoy.config.metrics.v3.MetricsServiceConfig
+      transport_api_version: V3
+      grpc_service:
+        envoy_grpc:
+          cluster_name: metrics_cluster
+static_resources:
+  clusters:
+    - connect_timeout: 1s
+      dns_lookup_family: V4_ONLY
+      dns_refresh_rate: 30s
+      lb_policy: ROUND_ROBIN
+      typed_extension_protocol_options:
+        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":
+          "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+          explicit_http_config:
+            http2_protocol_options:
+              connection_keepalive:
+                interval: 30s
+                timeout: 5s
+      load_assignment:
+        cluster_name: metrics_cluster
+        endpoints:
+          - lb_endpoints:
+              - endpoint:
+                  address:
+                    socket_address:
+                      address: skywalking-oap.skywalking
+                      portValue: 11800
+      name: metrics_cluster
+      respect_dns_ttl: true
+      type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml
new file mode 100644
index 000000000..ccfff8e1f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml
@@ -0,0 +1,140 @@
+admin:
+  accessLog:
+  - name: envoy.access_loggers.file
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 19000
+dynamicResources:
+  adsConfig:
+    apiType: DELTA_GRPC
+    grpcServices:
+    - envoyGrpc:
+        clusterName: xds_cluster
+    setNodeOnFirstMessageOnly: true
+    transportApiVersion: V3
+  cdsConfig:
+    ads: {}
+    resourceApiVersion: V3
+  ldsConfig:
+    ads: {}
+    resourceApiVersion: V3
+layeredRuntime:
+  layers:
+  - name: global_config
+    staticLayer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+staticResources:
+  clusters:
+  # - connectTimeout: 0.250s
+  #   loadAssignment:
+  #     clusterName: prometheus_stats
+  #     endpoints:
+  #     - lbEndpoints:
+  #       - endpoint:
+  #           address:
+  #             socketAddress:
+  #               address: 0.0.0.0
+  #               portValue: 19000
+  #   name: prometheus_stats
+  #   type: STATIC
+  - connectTimeout: 10s
+    loadAssignment:
+      clusterName: xds_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: envoy-gateway
+                portValue: 18000
+          loadBalancingWeight: 1
+        loadBalancingWeight: 1
+    name: xds_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          tlsParams:
+            tlsMinimumProtocolVersion: TLSv1_2
+            tlsMaximumProtocolVersion: TLSv1_2
+          tlsCertificates:
+            privateKey:
+              filename: '/home/wso2/security/keystore/router.key'
+            certificateChain:
+              filename: '/home/wso2/security/keystore/router.crt'
+          validationContext:
+            trustedCA:
+              filename: '/home/wso2/security/truststore/adapter.crt'
+    type: STRICT_DNS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions:
+            connectionKeepalive:
+              interval: 30s
+              timeout: 5s
+  - connectTimeout: 1s
+    dnsLookupFamily: V4_ONLY
+    dnsRefreshRate: 30s
+    loadAssignment:
+      clusterName: metrics_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: skywalking-oap.skywalking
+                portValue: 11800
+    name: metrics_cluster
+    respectDnsTtl: true
+    type: STRICT_DNS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions:
+            connectionKeepalive:
+              interval: 30s
+              timeout: 5s
+  listeners:
+  - address:
+      socketAddress:
+        address: 0.0.0.0
+        portValue: 19001
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          httpFilters:
+          - name: envoy.filters.http.health_check
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              headers:
+              - name: :path
+                stringMatch:
+                  exact: /ready
+              passThroughMode: false
+          - name: envoy.filters.http.router
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+          routeConfig:
+            name: local_route
+          statPrefix: eg-ready-http
+    name: envoy-gateway-proxy-ready-0.0.0.0-19001
+statsSinks:
+- name: envoy.stat_sinks.metrics_service
+  typedConfig:
+    '@type': type.googleapis.com/envoy.config.metrics.v3.MetricsServiceConfig
+    grpcService:
+      envoyGrpc:
+        clusterName: metrics_cluster
+    transportApiVersion: V3
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml
new file mode 100644
index 000000000..7364bc85a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml
@@ -0,0 +1,112 @@
+admin:
+  access_log:
+  - name: envoy.access_loggers.file
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 19000
+stats_config:
+  stats_matcher:
+    inclusion_list:
+      patterns:
+      - exact: http.foo.bar.cluster.upstream_rq
+      - prefix: http
+      - prefix: cluster
+      - suffix: upstream_rq
+      - safe_regex:
+          google_re2: {}
+          regex: virtual.*
+layered_runtime:
+  layers:
+  - name: global_config
+    static_layer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+dynamic_resources:
+  ads_config:
+    api_type: DELTA_GRPC
+    transport_api_version: V3
+    grpc_services:
+    - envoy_grpc:
+        cluster_name: xds_cluster
+    set_node_on_first_message_only: true
+  lds_config:
+    ads: {}
+    resource_api_version: V3
+  cds_config:
+    ads: {}
+    resource_api_version: V3
+static_resources:
+  listeners:
+  - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+    address:
+      socket_address:
+        address: 0.0.0.0
+        port_value: 19001
+        protocol: TCP
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: eg-ready-http
+          route_config:
+            name: local_route
+          http_filters:
+          - name: envoy.filters.http.health_check
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              pass_through_mode: false
+              headers:
+              - name: ":path"
+                string_match:
+                  exact: /ready
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  - connect_timeout: 10s
+    load_assignment:
+      cluster_name: xds_cluster
+      endpoints:
+      - load_balancing_weight: 1
+        lb_endpoints:
+        - load_balancing_weight: 1
+          endpoint:
+            address:
+              socket_address:
+                address: envoy-gateway
+                port_value: 18000
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options:
+            connection_keepalive:
+              interval: 30s
+              timeout: 5s
+    name: xds_cluster
+    type: STRICT_DNS
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_maximum_protocol_version: TLSv1_3
+          tls_certificate_sds_secret_configs:
+          - name: xds_certificate
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-certificate.json"
+              resource_api_version: V3
+          validation_context_sds_secret_config:
+            name: xds_trusted_ca
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-trusted-ca.json"
+              resource_api_version: V3
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml
new file mode 100644
index 000000000..ca8a5c09c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml
@@ -0,0 +1,101 @@
+admin:
+  access_log:
+  - name: envoy.access_loggers.file
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 19000
+layered_runtime:
+  layers:
+  - name: global_config
+    static_layer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+dynamic_resources:
+  ads_config:
+    api_type: DELTA_GRPC
+    transport_api_version: V3
+    grpc_services:
+    - envoy_grpc:
+        cluster_name: xds_cluster
+    set_node_on_first_message_only: true
+  lds_config:
+    ads: {}
+    resource_api_version: V3
+  cds_config:
+    ads: {}
+    resource_api_version: V3
+static_resources:
+  listeners:
+  - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+    address:
+      socket_address:
+        address: 0.0.0.0
+        port_value: 19001
+        protocol: TCP
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: eg-ready-http
+          route_config:
+            name: local_route
+          http_filters:
+          - name: envoy.filters.http.health_check
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              pass_through_mode: false
+              headers:
+              - name: ":path"
+                string_match:
+                  exact: /ready
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  - connect_timeout: 10s
+    load_assignment:
+      cluster_name: xds_cluster
+      endpoints:
+      - load_balancing_weight: 1
+        lb_endpoints:
+        - load_balancing_weight: 1
+          endpoint:
+            address:
+              socket_address:
+                address: envoy-gateway
+                port_value: 18000
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options:
+            connection_keepalive:
+              interval: 30s
+              timeout: 5s
+    name: xds_cluster
+    type: STRICT_DNS
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_maximum_protocol_version: TLSv1_3
+          tls_certificate_sds_secret_configs:
+          - name: xds_certificate
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-certificate.json"
+              resource_api_version: V3
+          validation_context_sds_secret_config:
+            name: xds_trusted_ca
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-trusted-ca.json"
+              resource_api_version: V3
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml
new file mode 100644
index 000000000..ca8a5c09c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml
@@ -0,0 +1,101 @@
+admin:
+  access_log:
+  - name: envoy.access_loggers.file
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 19000
+layered_runtime:
+  layers:
+  - name: global_config
+    static_layer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+dynamic_resources:
+  ads_config:
+    api_type: DELTA_GRPC
+    transport_api_version: V3
+    grpc_services:
+    - envoy_grpc:
+        cluster_name: xds_cluster
+    set_node_on_first_message_only: true
+  lds_config:
+    ads: {}
+    resource_api_version: V3
+  cds_config:
+    ads: {}
+    resource_api_version: V3
+static_resources:
+  listeners:
+  - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+    address:
+      socket_address:
+        address: 0.0.0.0
+        port_value: 19001
+        protocol: TCP
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: eg-ready-http
+          route_config:
+            name: local_route
+          http_filters:
+          - name: envoy.filters.http.health_check
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              pass_through_mode: false
+              headers:
+              - name: ":path"
+                string_match:
+                  exact: /ready
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  - connect_timeout: 10s
+    load_assignment:
+      cluster_name: xds_cluster
+      endpoints:
+      - load_balancing_weight: 1
+        lb_endpoints:
+        - load_balancing_weight: 1
+          endpoint:
+            address:
+              socket_address:
+                address: envoy-gateway
+                port_value: 18000
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options:
+            connection_keepalive:
+              interval: 30s
+              timeout: 5s
+    name: xds_cluster
+    type: STRICT_DNS
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_maximum_protocol_version: TLSv1_3
+          tls_certificate_sds_secret_configs:
+          - name: xds_certificate
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-certificate.json"
+              resource_api_version: V3
+          validation_context_sds_secret_config:
+            name: xds_trusted_ca
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-trusted-ca.json"
+              resource_api_version: V3
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml
new file mode 100644
index 000000000..82fbd38ad
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml
@@ -0,0 +1,126 @@
+admin:
+  access_log:
+  - name: envoy.access_loggers.file
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 19000
+layered_runtime:
+  layers:
+  - name: global_config
+    static_layer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+dynamic_resources:
+  ads_config:
+    api_type: DELTA_GRPC
+    transport_api_version: V3
+    grpc_services:
+    - envoy_grpc:
+        cluster_name: xds_cluster
+    set_node_on_first_message_only: true
+  lds_config:
+    ads: {}
+    resource_api_version: V3
+  cds_config:
+    ads: {}
+    resource_api_version: V3
+stats_sinks:
+- name: "envoy.stat_sinks.open_telemetry"
+  typed_config:
+    "@type": type.googleapis.com/envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig
+    grpc_service:
+      envoy_grpc:
+        cluster_name: otel_metric_sink_0
+static_resources:
+  listeners:
+  - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+    address:
+      socket_address:
+        address: 0.0.0.0
+        port_value: 19001
+        protocol: TCP
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: eg-ready-http
+          route_config:
+            name: local_route
+          http_filters:
+          - name: envoy.filters.http.health_check
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              pass_through_mode: false
+              headers:
+              - name: ":path"
+                string_match:
+                  exact: /ready
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  - name: otel_metric_sink_0
+    connect_timeout: 0.250s
+    type: STRICT_DNS
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options: {}
+    lb_policy: ROUND_ROBIN
+    load_assignment:
+      cluster_name: otel_metric_sink_0
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: otel-collector.monitoring.svc
+                port_value: 4317
+  - connect_timeout: 10s
+    load_assignment:
+      cluster_name: xds_cluster
+      endpoints:
+      - load_balancing_weight: 1
+        lb_endpoints:
+        - load_balancing_weight: 1
+          endpoint:
+            address:
+              socket_address:
+                address: envoy-gateway
+                port_value: 18000
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options:
+            connection_keepalive:
+              interval: 30s
+              timeout: 5s
+    name: xds_cluster
+    type: STRICT_DNS
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_maximum_protocol_version: TLSv1_3
+          tls_certificate_sds_secret_configs:
+          - name: xds_certificate
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-certificate.json"
+              resource_api_version: V3
+          validation_context_sds_secret_config:
+            name: xds_trusted_ca
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-trusted-ca.json"
+              resource_api_version: V3
diff --git a/adapter/internal/operator/gateway-api/contexts.go b/adapter/internal/operator/gateway-api/contexts.go
new file mode 100644
index 000000000..40ab07009
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/contexts.go
@@ -0,0 +1,453 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"reflect"
+	"time"
+
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+// GatewayContext wraps a Gateway and provides helper methods for setting conditions, accessing Listeners, etc.
+type GatewayContext struct {
+	*gwapiv1.Gateway
+	listeners []*ListenerContext
+}
+
+// ResetListeners resets the listener statuses and re-generates the GatewayContext
+// ListenerContexts from the Gateway spec.
+func (g *GatewayContext) ResetListeners() {
+	lenListener := len(g.Spec.Listeners)
+	g.Status.Listeners = make([]gwapiv1.ListenerStatus, lenListener)
+	g.listeners = make([]*ListenerContext, lenListener)
+	for i := range g.Spec.Listeners {
+		listener := &g.Spec.Listeners[i]
+		g.Status.Listeners[i] = gwapiv1.ListenerStatus{Name: listener.Name}
+		g.listeners[i] = &ListenerContext{
+			listenerStatusID: i,
+			Listener:         listener,
+			gateway:          g.Gateway,
+		}
+	}
+}
+
+// ListenerContext wraps a Listener and provides helper methods for
+// setting conditions and other status information on the associated
+// Gateway, etc.
+type ListenerContext struct {
+	*gwapiv1.Listener
+
+	gateway           *gwapiv1.Gateway
+	listenerStatusID  int
+	namespaceSelector labels.Selector
+	tlsSecrets        []*v1.Secret
+}
+
+func (l *ListenerContext) SetCondition(conditionType gwapiv1.ListenerConditionType, status metav1.ConditionStatus, reason gwapiv1.ListenerConditionReason, message string) {
+	cond := metav1.Condition{
+		Type:               string(conditionType),
+		Status:             status,
+		Reason:             string(reason),
+		Message:            message,
+		ObservedGeneration: l.gateway.Generation,
+		LastTransitionTime: metav1.NewTime(time.Now()),
+	}
+
+	index := -1
+	for i, existing := range l.gateway.Status.Listeners[l.listenerStatusID].Conditions {
+		if existing.Type == cond.Type {
+			// return early if the condition is unchanged
+			if existing.Status == cond.Status &&
+				existing.Reason == cond.Reason &&
+				existing.Message == cond.Message &&
+				existing.ObservedGeneration == cond.ObservedGeneration {
+				return
+			}
+			index = i
+			break
+		}
+	}
+
+	if index > -1 {
+		l.gateway.Status.Listeners[l.listenerStatusID].Conditions[index] = cond
+	} else {
+		l.gateway.Status.Listeners[l.listenerStatusID].Conditions = append(l.gateway.Status.Listeners[l.listenerStatusID].Conditions, cond)
+	}
+}
+
+func (l *ListenerContext) SetSupportedKinds(kinds ...gwapiv1.RouteGroupKind) {
+	l.gateway.Status.Listeners[l.listenerStatusID].SupportedKinds = kinds
+}
+
+func (l *ListenerContext) IncrementAttachedRoutes() {
+	l.gateway.Status.Listeners[l.listenerStatusID].AttachedRoutes++
+}
+
+func (l *ListenerContext) AttachedRoutes() int32 {
+	return l.gateway.Status.Listeners[l.listenerStatusID].AttachedRoutes
+}
+
+func (l *ListenerContext) AllowsKind(kind gwapiv1.RouteGroupKind) bool {
+	for _, allowed := range l.gateway.Status.Listeners[l.listenerStatusID].SupportedKinds {
+		if GroupDerefOr(allowed.Group, "") == GroupDerefOr(kind.Group, "") &&
+			allowed.Kind == kind.Kind {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (l *ListenerContext) AllowsNamespace(namespace *v1.Namespace) bool {
+	if namespace == nil {
+		return false
+	}
+
+	if l.AllowedRoutes == nil || l.AllowedRoutes.Namespaces == nil || l.AllowedRoutes.Namespaces.From == nil {
+		return l.gateway.Namespace == namespace.Name
+	}
+
+	switch *l.AllowedRoutes.Namespaces.From {
+	case gwapiv1.NamespacesFromAll:
+		return true
+	case gwapiv1.NamespacesFromSelector:
+		if l.namespaceSelector == nil {
+			return false
+		}
+		return l.namespaceSelector.Matches(labels.Set(namespace.Labels))
+	default:
+		// NamespacesFromSame is the default
+		return l.gateway.Namespace == namespace.Name
+	}
+}
+
+func (l *ListenerContext) IsReady() bool {
+	for _, cond := range l.gateway.Status.Listeners[l.listenerStatusID].Conditions {
+		if cond.Type == string(gwapiv1.ListenerConditionProgrammed) && cond.Status == metav1.ConditionTrue {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (l *ListenerContext) GetConditions() []metav1.Condition {
+	return l.gateway.Status.Listeners[l.listenerStatusID].Conditions
+}
+
+func (l *ListenerContext) SetTLSSecrets(tlsSecrets []*v1.Secret) {
+	l.tlsSecrets = tlsSecrets
+}
+
+// RouteContext represents a generic Route object (HTTPRoute, TLSRoute, etc.)
+// that can reference Gateway objects.
+type RouteContext interface {
+	client.Object
+}
+
+// HTTPRouteContext wraps an HTTPRoute and provides helper methods for
+// accessing the route's parents.
+type HTTPRouteContext struct {
+	// GatewayControllerName is the name of the Gateway API controller.
+	GatewayControllerName string
+
+	*gwapiv1.HTTPRoute
+
+	ParentRefs map[gwapiv1.ParentReference]*RouteParentContext
+}
+
+// GRPCRouteContext wraps a GRPCRoute and provides helper methods for
+// accessing the route's parents.
+type GRPCRouteContext struct {
+	// GatewayControllerName is the name of the Gateway API controller.
+	GatewayControllerName string
+
+	*v1alpha2.GRPCRoute
+
+	ParentRefs map[gwapiv1.ParentReference]*RouteParentContext
+}
+
+// TLSRouteContext wraps a TLSRoute and provides helper methods for
+// accessing the route's parents.
+type TLSRouteContext struct {
+	// GatewayControllerName is the name of the Gateway API controller.
+	GatewayControllerName string
+
+	*v1alpha2.TLSRoute
+
+	ParentRefs map[gwapiv1.ParentReference]*RouteParentContext
+}
+
+// UDPRouteContext wraps a UDPRoute and provides helper methods for
+// accessing the route's parents.
+type UDPRouteContext struct {
+	// GatewayControllerName is the name of the Gateway API controller.
+	GatewayControllerName string
+
+	*v1alpha2.UDPRoute
+
+	ParentRefs map[gwapiv1.ParentReference]*RouteParentContext
+}
+
+// TCPRouteContext wraps a TCPRoute and provides helper methods for
+// accessing the route's parents.
+type TCPRouteContext struct {
+	// GatewayControllerName is the name of the Gateway API controller.
+	GatewayControllerName string
+
+	*v1alpha2.TCPRoute
+
+	ParentRefs map[gwapiv1.ParentReference]*RouteParentContext
+}
+
+// GetRouteType returns the Kind of the Route object, HTTPRoute,
+// TLSRoute, TCPRoute, UDPRoute etc.
+func GetRouteType(route RouteContext) gwapiv1.Kind {
+	rv := reflect.ValueOf(route).Elem()
+	return gwapiv1.Kind(rv.FieldByName("Kind").String())
+}
+
+// TODO: [v1alpha2-gwapiv1] This should not be required once all Route
+// objects being implemented are of type gwapiv1.
+// GetHostnames returns the hosts targeted by the Route object.
+func GetHostnames(route RouteContext) []string {
+	rv := reflect.ValueOf(route).Elem()
+	kind := rv.FieldByName("Kind").String()
+	if kind == KindTCPRoute || kind == KindUDPRoute {
+		return nil
+	}
+
+	hs := rv.FieldByName("Spec").FieldByName("Hostnames")
+	hostnames := make([]string, hs.Len())
+	for i := 0; i < len(hostnames); i++ {
+		hostnames[i] = hs.Index(i).String()
+	}
+	return hostnames
+}
+
+// TODO: [v1alpha2-gwapiv1] This should not be required once all Route
+// objects being implemented are of type gwapiv1.
+// GetParentReferences returns the ParentReference of the Route object.
+func GetParentReferences(route RouteContext) []gwapiv1.ParentReference {
+	rv := reflect.ValueOf(route).Elem()
+	kind := rv.FieldByName("Kind").String()
+	pr := rv.FieldByName("Spec").FieldByName("ParentRefs")
+	if kind == KindHTTPRoute || kind == KindGRPCRoute {
+		return pr.Interface().([]gwapiv1.ParentReference)
+	}
+
+	parentReferences := make([]gwapiv1.ParentReference, pr.Len())
+	for i := 0; i < len(parentReferences); i++ {
+		p := pr.Index(i).Interface().(gwapiv1.ParentReference)
+		parentReferences[i] = UpgradeParentReference(p)
+	}
+	return parentReferences
+}
+
+// GetRouteStatus returns the RouteStatus object associated with the Route.
+func GetRouteStatus(route RouteContext) *gwapiv1.RouteStatus {
+	rv := reflect.ValueOf(route).Elem()
+	rs := rv.FieldByName("Status").FieldByName("RouteStatus").Interface().(gwapiv1.RouteStatus)
+	return &rs
+}
+
+// GetRouteParentContext returns RouteParentContext by using the Route
+// objects' ParentReference.
+func GetRouteParentContext(route RouteContext, forParentRef gwapiv1.ParentReference) *RouteParentContext {
+	rv := reflect.ValueOf(route).Elem()
+	pr := rv.FieldByName("ParentRefs")
+	if pr.IsNil() {
+		mm := reflect.MakeMap(reflect.TypeOf(map[gwapiv1.ParentReference]*RouteParentContext{}))
+		pr.Set(mm)
+	}
+
+	if p := pr.MapIndex(reflect.ValueOf(forParentRef)); p.IsValid() && !p.IsZero() {
+		ctx := p.Interface().(*RouteParentContext)
+		return ctx
+	}
+
+	isHTTPRoute := false
+	if rv.FieldByName("Kind").String() == KindHTTPRoute {
+		isHTTPRoute = true
+	}
+
+	var parentRef *gwapiv1.ParentReference
+	specParentRefs := rv.FieldByName("Spec").FieldByName("ParentRefs")
+	for i := 0; i < specParentRefs.Len(); i++ {
+		p := specParentRefs.Index(i).Interface().(gwapiv1.ParentReference)
+		up := p
+		if !isHTTPRoute {
+			up = UpgradeParentReference(p)
+		}
+		if reflect.DeepEqual(up, forParentRef) {
+			if isHTTPRoute {
+				parentRef = &p
+			} else {
+				upgraded := UpgradeParentReference(p)
+				parentRef = &upgraded
+			}
+			break
+		}
+	}
+	if parentRef == nil {
+		panic("parentRef not found")
+	}
+
+	routeParentStatusIdx := -1
+	statusParents := rv.FieldByName("Status").FieldByName("Parents")
+	for i := 0; i < statusParents.Len(); i++ {
+		p := statusParents.Index(i).FieldByName("ParentRef").Interface().(gwapiv1.ParentReference)
+		if !isHTTPRoute {
+			p = UpgradeParentReference(p)
+			defaultNamespace := gwapiv1.Namespace(metav1.NamespaceDefault)
+			if forParentRef.Namespace == nil {
+				forParentRef.Namespace = &defaultNamespace
+			}
+			if p.Namespace == nil {
+				p.Namespace = &defaultNamespace
+			}
+		}
+		if reflect.DeepEqual(p, forParentRef) {
+			routeParentStatusIdx = i
+			break
+		}
+	}
+	if routeParentStatusIdx == -1 {
+		tmpPR := forParentRef
+		if !isHTTPRoute {
+			tmpPR = DowngradeParentReference(tmpPR)
+		}
+		rParentStatus := v1alpha2.RouteParentStatus{
+			ControllerName: v1alpha2.GatewayController(rv.FieldByName("GatewayControllerName").String()),
+			ParentRef:      tmpPR,
+		}
+		statusParents.Set(reflect.Append(statusParents, reflect.ValueOf(rParentStatus)))
+		routeParentStatusIdx = statusParents.Len() - 1
+	}
+
+	ctx := &RouteParentContext{
+		ParentReference:      parentRef,
+		routeParentStatusIdx: routeParentStatusIdx,
+	}
+	rctx := reflect.ValueOf(ctx)
+	rctx.Elem().FieldByName(string(GetRouteType(route))).Set(rv.Field(1))
+	pr.SetMapIndex(reflect.ValueOf(forParentRef), rctx)
+	return ctx
+}
+
+// RouteParentContext wraps a ParentReference and provides helper methods for
+// setting conditions and other status information on the associated
+// HTTPRoute, TLSRoute etc.
+type RouteParentContext struct {
+	*gwapiv1.ParentReference
+
+	// TODO: [v1alpha2-gwapiv1] This can probably be replaced with
+	// a single field pointing to *gwapiv1.RouteStatus.
+	HTTPRoute *gwapiv1.HTTPRoute
+	GRPCRoute *v1alpha2.GRPCRoute
+	TLSRoute  *v1alpha2.TLSRoute
+	TCPRoute  *v1alpha2.TCPRoute
+	UDPRoute  *v1alpha2.UDPRoute
+
+	routeParentStatusIdx int
+	listeners            []*ListenerContext
+}
+
+func (r *RouteParentContext) SetListeners(listeners ...*ListenerContext) {
+	r.listeners = append(r.listeners, listeners...)
+}
+
+func (r *RouteParentContext) SetCondition(route RouteContext, conditionType gwapiv1.RouteConditionType, status metav1.ConditionStatus, reason gwapiv1.RouteConditionReason, message string) {
+	cond := metav1.Condition{
+		Type:               string(conditionType),
+		Status:             status,
+		Reason:             string(reason),
+		Message:            message,
+		ObservedGeneration: route.GetGeneration(),
+		LastTransitionTime: metav1.NewTime(time.Now()),
+	}
+
+	idx := -1
+	routeStatus := GetRouteStatus(route)
+	for i, existing := range routeStatus.Parents[r.routeParentStatusIdx].Conditions {
+		if existing.Type == cond.Type {
+			// return early if the condition is unchanged
+			if existing.Status == cond.Status &&
+				existing.Reason == cond.Reason &&
+				existing.Message == cond.Message &&
+				existing.ObservedGeneration == cond.ObservedGeneration {
+				return
+			}
+			idx = i
+			break
+		}
+	}
+
+	if idx > -1 {
+		routeStatus.Parents[r.routeParentStatusIdx].Conditions[idx] = cond
+	} else {
+		routeStatus.Parents[r.routeParentStatusIdx].Conditions = append(routeStatus.Parents[r.routeParentStatusIdx].Conditions, cond)
+	}
+}
+
+func (r *RouteParentContext) ResetConditions(route RouteContext) {
+	routeStatus := GetRouteStatus(route)
+	routeStatus.Parents[r.routeParentStatusIdx].Conditions = make([]metav1.Condition, 0)
+}
+
+func (r *RouteParentContext) HasCondition(route RouteContext, condType gwapiv1.RouteConditionType, status metav1.ConditionStatus) bool {
+	var conditions []metav1.Condition
+	routeStatus := GetRouteStatus(route)
+	conditions = routeStatus.Parents[r.routeParentStatusIdx].Conditions
+	for _, c := range conditions {
+		if c.Type == string(condType) && c.Status == status {
+			return true
+		}
+	}
+	return false
+}
+
+// BackendRefContext represents a generic BackendRef object (HTTPBackendRef, GRPCBackendRef or BackendRef itself)
+type BackendRefContext any
+
+func GetBackendRef(b BackendRefContext) *gwapiv1.BackendRef {
+	rv := reflect.ValueOf(b)
+	br := rv.FieldByName("BackendRef")
+	if br.IsValid() {
+		backendRef := br.Interface().(gwapiv1.BackendRef)
+		return &backendRef
+
+	}
+	backendRef := b.(gwapiv1.BackendRef)
+	return &backendRef
+}
+
+func GetFilters(b BackendRefContext) any {
+	return reflect.ValueOf(b).FieldByName("Filters").Interface()
+}
diff --git a/adapter/internal/operator/gateway-api/crypto/certgen.go b/adapter/internal/operator/gateway-api/crypto/certgen.go
new file mode 100644
index 000000000..87a8f1bcd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/crypto/certgen.go
@@ -0,0 +1,321 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package crypto
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha1" // nolint:gosec
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"time"
+
+	"github.com/wso2/apk/adapter/config"
+)
+
+const (
+	// DefaultEnvoyGatewayDNSPrefix defines the default Envoy Gateway DNS prefix.
+	DefaultEnvoyGatewayDNSPrefix = "envoy-gateway"
+
+	// DefaultEnvoyDNSPrefix defines the default Envoy DNS prefix.
+	DefaultEnvoyDNSPrefix = "*"
+
+	// DefaultCertificateLifetime holds the default certificate lifetime (in days).
+	DefaultCertificateLifetime = 365 * 5
+
+	// keySize sets the RSA key size to 2048 bits. This is minimum recommended size
+	// for RSA keys.
+	keySize = 2048
+)
+
+// Configuration holds config parameters used for generating certificates.
+type Configuration struct {
+	// Provider defines the desired cert provider and provider-specific
+	// configuration.
+	Provider *CertProvider
+}
+
+func (c *Configuration) getProvider() {
+	if c.Provider == nil {
+		c.Provider = &CertProvider{
+			Type: ProviderTypeEnvoyGateway,
+		}
+	}
+}
+
+// CertProvider defines the provider of certificates.
+type CertProvider struct {
+	// Type is the type of provider to use for managing certificates.
+	Type ProviderType `json:"type"`
+}
+
+// ProviderType defines the types of supported certificate providers.
+type ProviderType string
+
+const (
+	// ProviderTypeEnvoyGateway defines the "EnvoyGateway" provider.
+	// EnvoyGateway implements a self-signed CA and generates server
+	// certs for Envoy Gateway and Envoy.
+	ProviderTypeEnvoyGateway ProviderType = "EnvoyGateway"
+)
+
+// Certificates contains a set of Certificates as []byte each holding
+// the CA Cert along with Envoy Gateway & Envoy certificates.
+type Certificates struct {
+	CACertificate             []byte
+	EnvoyGatewayCertificate   []byte
+	EnvoyGatewayPrivateKey    []byte
+	EnvoyCertificate          []byte
+	EnvoyPrivateKey           []byte
+	EnvoyRateLimitCertificate []byte
+	EnvoyRateLimitPrivateKey  []byte
+	OIDCHMACSecret            []byte
+}
+
+// certificateRequest defines a certificate request.
+type certificateRequest struct {
+	caCertPEM  []byte
+	caKeyPEM   []byte
+	expiry     time.Time
+	commonName string
+	altNames   []string
+}
+
+// GenerateCerts generates a CA Certificate along with certificates for Envoy Gateway
+// and Envoy returning them as a *Certificates struct or error if encountered.
+func GenerateCerts() (*Certificates, error) {
+	conf := config.ReadConfigs()
+	gatewayNs := conf.Envoy.Namespace
+	certCfg := new(Configuration)
+
+	certCfg.getProvider()
+	switch certCfg.Provider.Type {
+	case ProviderTypeEnvoyGateway:
+		now := time.Now()
+		expiry := now.Add(24 * time.Duration(DefaultCertificateLifetime) * time.Hour)
+		caCertPEM, caKeyPEM, err := newCA(DefaultEnvoyGatewayDNSPrefix, expiry)
+		if err != nil {
+			return nil, err
+		}
+
+		var egDNSNames, envoyDNSNames []string
+		egDNSNames = kubeServiceNames(DefaultEnvoyGatewayDNSPrefix, gatewayNs, "cluster.local")
+		envoyDNSNames = append(envoyDNSNames, fmt.Sprintf("*.%s", gatewayNs))
+
+		egCertReq := &certificateRequest{
+			caCertPEM:  caCertPEM,
+			caKeyPEM:   caKeyPEM,
+			expiry:     expiry,
+			commonName: DefaultEnvoyGatewayDNSPrefix,
+			altNames:   egDNSNames,
+		}
+
+		egCert, egKey, err := newCert(egCertReq)
+		if err != nil {
+			return nil, err
+		}
+
+		envoyCertReq := &certificateRequest{
+			caCertPEM:  caCertPEM,
+			caKeyPEM:   caKeyPEM,
+			expiry:     expiry,
+			commonName: DefaultEnvoyDNSPrefix,
+			altNames:   envoyDNSNames,
+		}
+
+		envoyCert, envoyKey, err := newCert(envoyCertReq)
+		if err != nil {
+			return nil, err
+		}
+
+		envoyRateLimitCertReq := &certificateRequest{
+			caCertPEM:  caCertPEM,
+			caKeyPEM:   caKeyPEM,
+			expiry:     expiry,
+			commonName: DefaultEnvoyDNSPrefix,
+			altNames:   envoyDNSNames,
+		}
+
+		envoyRateLimitCert, envoyRateLimitKey, err := newCert(envoyRateLimitCertReq)
+		if err != nil {
+			return nil, err
+		}
+
+		oidcHMACSecret, err := generateHMACSecret()
+		if err != nil {
+			return nil, err
+		}
+
+		return &Certificates{
+			CACertificate:             caCertPEM,
+			EnvoyGatewayCertificate:   egCert,
+			EnvoyGatewayPrivateKey:    egKey,
+			EnvoyCertificate:          envoyCert,
+			EnvoyPrivateKey:           envoyKey,
+			EnvoyRateLimitCertificate: envoyRateLimitCert,
+			EnvoyRateLimitPrivateKey:  envoyRateLimitKey,
+			OIDCHMACSecret:            oidcHMACSecret,
+		}, nil
+	default:
+		// Envoy Gateway, e.g. self-signed CA, is the only supported certificate provider.
+		return nil, fmt.Errorf("unsupported certificate provider type %v", certCfg.Provider.Type)
+	}
+}
+
+// newCert generates a new keypair based on the given the request.
+// The return values are cert, key, err.
+func newCert(request *certificateRequest) ([]byte, []byte, error) {
+	caKeyPair, err := tls.X509KeyPair(request.caCertPEM, request.caKeyPEM)
+	if err != nil {
+		return nil, nil, err
+	}
+	caCert, err := x509.ParseCertificate(caKeyPair.Certificate[0])
+	if err != nil {
+		return nil, nil, err
+	}
+	caKey, ok := caKeyPair.PrivateKey.(*rsa.PrivateKey)
+	if !ok {
+		return nil, nil, fmt.Errorf("CA private key has unexpected type %T", caKeyPair.PrivateKey)
+	}
+
+	newKey, err := rsa.GenerateKey(rand.Reader, keySize)
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot generate key: %w", err)
+	}
+
+	now := time.Now()
+	template := &x509.Certificate{
+		SerialNumber: newSerial(now),
+		Subject: pkix.Name{
+			CommonName: request.commonName,
+		},
+		NotBefore:    now.UTC().AddDate(0, 0, -1),
+		NotAfter:     request.expiry.UTC(),
+		SubjectKeyId: bigIntHash(newKey.N),
+		KeyUsage: x509.KeyUsageDigitalSignature |
+			x509.KeyUsageDataEncipherment |
+			x509.KeyUsageKeyEncipherment |
+			x509.KeyUsageContentCommitment,
+		DNSNames: request.altNames,
+	}
+	newCert, err := x509.CreateCertificate(rand.Reader, template, caCert, &newKey.PublicKey, caKey)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	newKeyPEM := pem.EncodeToMemory(&pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(newKey),
+	})
+	newCertPEM := pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: newCert,
+	})
+	return newCertPEM, newKeyPEM, nil
+
+}
+
+// newCA generates a new CA, given the CA's CN and an expiry time.
+// The return order is cacert, cakey, error.
+func newCA(cn string, expiry time.Time) ([]byte, []byte, error) {
+	key, err := rsa.GenerateKey(rand.Reader, keySize)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	now := time.Now()
+	serial := newSerial(now)
+	template := &x509.Certificate{
+		SerialNumber: serial,
+		Subject: pkix.Name{
+			CommonName:   cn,
+			SerialNumber: serial.String(),
+		},
+		NotBefore:             now.UTC().AddDate(0, 0, -1),
+		NotAfter:              expiry.UTC(),
+		SubjectKeyId:          bigIntHash(key.N),
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		return nil, nil, err
+	}
+	certPEMData := pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: certDER,
+	})
+	keyPEMData := pem.EncodeToMemory(&pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(key),
+	})
+	return certPEMData, keyPEMData, nil
+}
+
+func newSerial(now time.Time) *big.Int {
+	return big.NewInt(int64(now.Nanosecond()))
+}
+
+// bigIntHash generates a SubjectKeyId by hashing the modulus of the private
+// key. This isn't one of the methods listed in RFC 5280 4.2.1.2, but that also
+// notes that other methods are acceptable.
+//
+// gosec makes a blanket claim that SHA-1 is unacceptable, which is
+// false here. The core Go method of generations the SubjectKeyId (see
+// https://github.com/golang/go/issues/26676) also uses SHA-1, as recommended
+// by RFC 5280.
+func bigIntHash(n *big.Int) []byte {
+	h := sha1.New()    // nolint:gosec
+	h.Write(n.Bytes()) // nolint:errcheck
+	return h.Sum(nil)
+}
+
+func kubeServiceNames(service, namespace, dnsName string) []string {
+	return []string{
+		service,
+		fmt.Sprintf("%s.%s", service, namespace),
+		fmt.Sprintf("%s.%s.svc", service, namespace),
+		fmt.Sprintf("%s.%s.svc.%s", service, namespace, dnsName),
+	}
+}
+
+func generateHMACSecret() ([]byte, error) {
+	// Set the desired length of the secret key in bytes
+	keyLength := 32
+
+	// Create a byte slice to hold the random bytes
+	key := make([]byte, keyLength)
+
+	// Read random bytes from the cryptographically secure random number generator
+	_, err := rand.Read(key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate hmack secret key: %w", err)
+	}
+
+	return key, nil
+}
diff --git a/adapter/internal/operator/gateway-api/crypto/certgen_test.go b/adapter/internal/operator/gateway-api/crypto/certgen_test.go
new file mode 100644
index 000000000..df4d5c399
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/crypto/certgen_test.go
@@ -0,0 +1,174 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package crypto
+
+import (
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateCerts(t *testing.T) {
+	type testcase struct {
+		certConfig              *Configuration
+		wantEnvoyGatewayDNSName string
+		wantEnvoyDNSName        string
+	}
+
+	run := func(t *testing.T, name string, tc testcase) {
+		t.Helper()
+
+		t.Run(name, func(t *testing.T) {
+			t.Helper()
+
+			got, err := GenerateCerts()
+			require.NoError(t, err)
+
+			roots := x509.NewCertPool()
+			ok := roots.AppendCertsFromPEM(got.CACertificate)
+			require.Truef(t, ok, "Failed to set up CA cert for testing, maybe it's an invalid PEM")
+
+			currentTime := time.Now()
+
+			err = verifyCert(got.EnvoyGatewayCertificate, roots, tc.wantEnvoyGatewayDNSName, currentTime)
+			require.NoErrorf(t, err, "Validating %s failed", name)
+
+			err = verifyCert(got.EnvoyCertificate, roots, tc.wantEnvoyDNSName, currentTime)
+			require.NoErrorf(t, err, "Validating %s failed", name)
+		})
+	}
+
+	run(t, "no configuration - use defaults", testcase{
+		certConfig:              &Configuration{},
+		wantEnvoyGatewayDNSName: DefaultEnvoyGatewayDNSPrefix,
+		wantEnvoyDNSName:        fmt.Sprintf("*.%s", "apk"),
+	})
+}
+
+func TestGeneratedValidKubeCerts(t *testing.T) {
+	now := time.Now()
+	expiry := now.Add(24 * 365 * time.Hour)
+
+	caCert, caKey, err := newCA("envoy-gateway", expiry)
+	require.NoErrorf(t, err, "Failed to generate CA cert")
+
+	egCertReq := &certificateRequest{
+		caCertPEM:  caCert,
+		caKeyPEM:   caKey,
+		expiry:     expiry,
+		commonName: "envoy-gateway",
+		altNames:   kubeServiceNames("envoy-gateway", "apk", "cluster.local"),
+	}
+	egCert, _, err := newCert(egCertReq)
+	require.NoErrorf(t, err, "Failed to generate Envoy Gateway cert")
+
+	roots := x509.NewCertPool()
+	ok := roots.AppendCertsFromPEM(caCert)
+	require.Truef(t, ok, "Failed to set up CA cert for testing, maybe it's an invalid PEM")
+
+	envoyCertReq := &certificateRequest{
+		caCertPEM:  caCert,
+		caKeyPEM:   caKey,
+		expiry:     expiry,
+		commonName: "envoy",
+		altNames:   kubeServiceNames("envoy", "apk", "cluster.local"),
+	}
+	envoyCert, _, err := newCert(envoyCertReq)
+	require.NoErrorf(t, err, "Failed to generate Envoy cert")
+
+	envoyRateLimitCertReq := &certificateRequest{
+		caCertPEM:  caCert,
+		caKeyPEM:   caKey,
+		expiry:     expiry,
+		commonName: "envoy",
+		altNames:   kubeServiceNames("envoy", "apk", "cluster.local"),
+	}
+
+	envoyRateLimitCert, _, err := newCert(envoyRateLimitCertReq)
+	require.NoErrorf(t, err, "Failed to generate Envoy Rate Limit Client cert")
+
+	tests := []struct {
+		name    string
+		cert    []byte
+		dnsName string
+	}{
+		{
+			name:    "envoy gateway cert",
+			cert:    egCert,
+			dnsName: "envoy-gateway",
+		},
+		{
+			name:    "envoy cert",
+			cert:    envoyCert,
+			dnsName: "envoy",
+		},
+		{
+			name:    "envoy rate limit client cert",
+			cert:    envoyRateLimitCert,
+			dnsName: "envoy",
+		},
+	}
+
+	for i := range tests {
+		tc := tests[i]
+		t.Run(tc.name, func(t *testing.T) {
+			err := verifyCert(tc.cert, roots, tc.dnsName, now)
+			require.NoErrorf(t, err, "Validating %s failed", tc.name)
+		})
+	}
+
+}
+
+func verifyCert(certPEM []byte, roots *x509.CertPool, dnsname string, currentTime time.Time) error {
+	block, _ := pem.Decode(certPEM)
+	if block == nil {
+		return fmt.Errorf("failed to decode %s certificate from PEM form", dnsname)
+	}
+
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return err
+	}
+
+	opts := x509.VerifyOptions{
+		DNSName:     dnsname,
+		Roots:       roots,
+		CurrentTime: currentTime,
+	}
+	if _, err = cert.Verify(opts); err != nil {
+		return fmt.Errorf("certificate verification failed: %w", err)
+	}
+
+	return nil
+}
+
+func TestGenerateHMACSecret(t *testing.T) {
+	bytes, _ := generateHMACSecret()
+	encodedSecret := base64.StdEncoding.EncodeToString(bytes)
+	fmt.Println("Base64 encoded secret:", encodedSecret)
+}
diff --git a/adapter/internal/operator/gateway-api/envoy/shutdown_manager.go b/adapter/internal/operator/gateway-api/envoy/shutdown_manager.go
new file mode 100644
index 000000000..94dc8b8c3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/envoy/shutdown_manager.go
@@ -0,0 +1,238 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package envoy
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"golang.org/x/sys/unix"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+)
+
+const (
+	// ShutdownManagerPort is the port Envoy shutdown manager will listen on.
+	ShutdownManagerPort = 19002
+	// ShutdownManagerHealthCheckPath is the path used for health checks.
+	ShutdownManagerHealthCheckPath = "/healthz"
+	// ShutdownManagerReadyPath is the path used to indicate shutdown readiness.
+	ShutdownManagerReadyPath = "/shutdown/ready"
+	// ShutdownReadyFile is the file used to indicate shutdown readiness.
+	ShutdownReadyFile = "/tmp/shutdown-ready"
+)
+
+// ShutdownManager serves shutdown manager process for Envoy proxies.
+func ShutdownManager(readyTimeout time.Duration) error {
+	// Setup HTTP handler
+	handler := http.NewServeMux()
+	handler.HandleFunc(ShutdownManagerHealthCheckPath, func(_ http.ResponseWriter, _ *http.Request) {})
+	handler.HandleFunc(ShutdownManagerReadyPath, func(w http.ResponseWriter, _ *http.Request) {
+		shutdownReadyHandler(w, readyTimeout, ShutdownReadyFile)
+	})
+
+	// Setup HTTP server
+	srv := http.Server{
+		Handler:           handler,
+		Addr:              fmt.Sprintf(":%d", ShutdownManagerPort),
+		ReadTimeout:       5 * time.Second,
+		ReadHeaderTimeout: 5 * time.Second,
+		WriteTimeout:      10 * time.Second,
+		IdleTimeout:       15 * time.Second,
+	}
+
+	// Setup signal handling
+	c := make(chan struct{})
+	go func() {
+		s := make(chan os.Signal, 1)
+		signal.Notify(s, os.Interrupt, syscall.SIGTERM)
+
+		r := <-s
+		loggers.LoggerAPKOperator.Info(fmt.Sprintf("received %s", unix.SignalName(r.(syscall.Signal))))
+
+		// Shutdown HTTP server without interrupting active connections
+		if err := srv.Shutdown(context.Background()); err != nil {
+			loggers.LoggerAPKOperator.Error(err, "server shutdown error")
+		}
+		close(c)
+	}()
+
+	// Start HTTP server
+	loggers.LoggerAPKOperator.Info("starting shutdown manager")
+	if err := srv.ListenAndServe(); !errors.Is(err, http.ErrServerClosed) {
+		loggers.LoggerAPKOperator.Error(err, "starting shutdown manager failed")
+	}
+
+	// Wait until done
+	<-c
+	return nil
+}
+
+// shutdownReadyHandler handles the endpoint used by a preStop hook on the Envoy
+// container to block until ready to terminate. After the graceful drain process
+// has completed a file will be written to indicate shutdown readiness.
+func shutdownReadyHandler(w http.ResponseWriter, readyTimeout time.Duration, readyFile string) {
+	var startTime = time.Now()
+
+	loggers.LoggerAPKOperator.Info("received shutdown ready request")
+
+	// Poll for shutdown readiness
+	for {
+		// Check if ready timeout is exceeded
+		elapsedTime := time.Since(startTime)
+		if elapsedTime > readyTimeout {
+			loggers.LoggerAPKOperator.Info("shutdown readiness timeout exceeded")
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+
+		_, err := os.Stat(readyFile)
+		switch {
+		case os.IsNotExist(err):
+			time.Sleep(1 * time.Second)
+		case err != nil:
+			loggers.LoggerAPKOperator.Error(err, "error checking for shutdown readiness")
+		case err == nil:
+			loggers.LoggerAPKOperator.Info("shutdown readiness detected")
+			return
+		}
+	}
+}
+
+// Shutdown is called from a preStop hook on the shutdown-manager container where
+// it will initiate a graceful drain sequence on the Envoy proxy and block until
+// connections are drained or a timeout is exceeded.
+func Shutdown(drainTimeout time.Duration, minDrainDuration time.Duration, exitAtConnections int) error {
+	var startTime = time.Now()
+	var allowedToExit = false
+
+	loggers.LoggerAPKOperator.Info(fmt.Sprintf("initiating graceful drain with %.0f second minimum drain period and %.0f second timeout",
+		minDrainDuration.Seconds(), drainTimeout.Seconds()))
+
+	// Start failing active health checks
+	if err := postEnvoyAdminAPI("healthcheck/fail"); err != nil {
+		loggers.LoggerAPKOperator.Error(err, "error failing active health checks")
+	}
+
+	// Initiate graceful drain sequence
+	if err := postEnvoyAdminAPI("drain_listeners?graceful&skip_exit"); err != nil {
+		loggers.LoggerAPKOperator.Error(err, "error initiating graceful drain")
+	}
+
+	// Poll total connections from Envoy admin API until minimum drain period has
+	// been reached and total connections reaches threshold or timeout is exceeded
+	for {
+		elapsedTime := time.Since(startTime)
+
+		conn, err := getTotalConnections()
+		if err != nil {
+			loggers.LoggerAPKOperator.Error(err, "error getting total connections")
+		}
+
+		if elapsedTime > minDrainDuration && !allowedToExit {
+			loggers.LoggerAPKOperator.Info(fmt.Sprintf("minimum drain period reached; will exit when total connections reaches %d", exitAtConnections))
+			allowedToExit = true
+		}
+
+		if elapsedTime > drainTimeout {
+			loggers.LoggerAPKOperator.Info("graceful drain sequence timeout exceeded")
+			break
+		} else if allowedToExit && conn != nil && *conn <= exitAtConnections {
+			loggers.LoggerAPKOperator.Info("graceful drain sequence completed")
+			break
+		}
+
+		time.Sleep(1 * time.Second)
+	}
+
+	// Signal to shutdownReadyHandler that drain process is complete
+	if _, err := os.Create(ShutdownReadyFile); err != nil {
+		loggers.LoggerAPKOperator.Error(err, "error creating shutdown ready file")
+		return err
+	}
+
+	return nil
+}
+
+// postEnvoyAdminAPI sends a POST request to the Envoy admin API
+func postEnvoyAdminAPI(path string) error {
+	resp, err := http.Post(fmt.Sprintf("http://%s:%d/%s",
+		bootstrap.EnvoyAdminAddress, bootstrap.EnvoyAdminPort, path), "application/json", nil)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("unexpected response status: %s", resp.Status)
+	}
+	return nil
+
+}
+
+// getTotalConnections retrieves the total number of open connections from Envoy's server.total_connections stat
+func getTotalConnections() (*int, error) {
+	// Send request to Envoy admin API to retrieve server.total_connections stat
+	resp, err := http.Get(fmt.Sprintf("http://%s:%d//stats?filter=^server\\.total_connections$&format=json",
+		bootstrap.EnvoyAdminAddress, bootstrap.EnvoyAdminPort))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("unexpected response status: %s", resp.Status)
+	}
+	// Define struct to decode JSON response into; expecting a single stat in the response in the format:
+	// {"stats":[{"name":"server.total_connections","value":123}]}
+	var r *struct {
+		Stats []struct {
+			Name  string
+			Value int
+		}
+	}
+
+	// Decode JSON response into struct
+	if err := json.NewDecoder(resp.Body).Decode(&r); err != nil {
+		return nil, err
+	}
+
+	// Defensive check for empty stats
+	if len(r.Stats) == 0 {
+		return nil, fmt.Errorf("no stats found")
+	}
+
+	// Log and return total connections
+	c := r.Stats[0].Value
+	loggers.LoggerAPKOperator.Info(fmt.Sprintf("total connections: %d", c))
+	return &c, nil
+
+}
diff --git a/adapter/internal/operator/gateway-api/filters.go b/adapter/internal/operator/gateway-api/filters.go
new file mode 100644
index 000000000..305574d7e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/filters.go
@@ -0,0 +1,792 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+type FiltersTranslator interface {
+	HTTPFiltersTranslator
+}
+
+var _ FiltersTranslator = (*Translator)(nil)
+
+type HTTPFiltersTranslator interface {
+	processURLRewriteFilter(rewrite *gwapiv1.HTTPURLRewriteFilter, filterContext *HTTPFiltersContext)
+	processRedirectFilter(redirect *gwapiv1.HTTPRequestRedirectFilter, filterContext *HTTPFiltersContext)
+	processRequestHeaderModifierFilter(headerModifier *gwapiv1.HTTPHeaderFilter, filterContext *HTTPFiltersContext)
+	processResponseHeaderModifierFilter(headerModifier *gwapiv1.HTTPHeaderFilter, filterContext *HTTPFiltersContext)
+	processRequestMirrorFilter(filterIdx int, mirror *gwapiv1.HTTPRequestMirrorFilter, filterContext *HTTPFiltersContext, resources *Resources)
+	processExtensionRefHTTPFilter(extRef *gwapiv1.LocalObjectReference, filterContext *HTTPFiltersContext, resources *Resources)
+	processUnsupportedHTTPFilter(filterType string, filterContext *HTTPFiltersContext)
+}
+
+// HTTPFiltersContext is the context of http filters processing.
+type HTTPFiltersContext struct {
+	*HTTPFilterIR
+
+	ParentRef *RouteParentContext
+	Route     RouteContext
+	RuleIdx   int
+}
+
+// HTTPFilterIR contains the ir processing results.
+type HTTPFilterIR struct {
+	DirectResponse   *ir.DirectResponse
+	RedirectResponse *ir.Redirect
+
+	URLRewrite *ir.URLRewrite
+
+	AddRequestHeaders    []ir.AddHeader
+	RemoveRequestHeaders []string
+
+	AddResponseHeaders    []ir.AddHeader
+	RemoveResponseHeaders []string
+
+	Mirrors []*ir.RouteDestination
+
+	ExtensionRefs []*ir.UnstructuredRef
+}
+
+// ProcessHTTPFilters translates gateway api http filters to IRs.
+func (t *Translator) ProcessHTTPFilters(parentRef *RouteParentContext,
+	route RouteContext,
+	filters []gwapiv1.HTTPRouteFilter,
+	ruleIdx int,
+	resources *Resources) *HTTPFiltersContext {
+	httpFiltersContext := &HTTPFiltersContext{
+		ParentRef:    parentRef,
+		Route:        route,
+		RuleIdx:      ruleIdx,
+		HTTPFilterIR: &HTTPFilterIR{},
+	}
+	for i := range filters {
+		filter := filters[i]
+		// If an invalid filter type has been configured then skip processing any more filters
+		if httpFiltersContext.DirectResponse != nil {
+			break
+		}
+		if err := ValidateHTTPRouteFilter(&filter); err != nil {
+			t.processInvalidHTTPFilter(string(filter.Type), httpFiltersContext, err)
+			break
+		}
+
+		switch filter.Type {
+		case gwapiv1.HTTPRouteFilterURLRewrite:
+			t.processURLRewriteFilter(filter.URLRewrite, httpFiltersContext)
+		case gwapiv1.HTTPRouteFilterRequestRedirect:
+			t.processRedirectFilter(filter.RequestRedirect, httpFiltersContext)
+		case gwapiv1.HTTPRouteFilterRequestHeaderModifier:
+			t.processRequestHeaderModifierFilter(filter.RequestHeaderModifier, httpFiltersContext)
+		case gwapiv1.HTTPRouteFilterResponseHeaderModifier:
+			t.processResponseHeaderModifierFilter(filter.ResponseHeaderModifier, httpFiltersContext)
+		case gwapiv1.HTTPRouteFilterRequestMirror:
+			t.processRequestMirrorFilter(i, filter.RequestMirror, httpFiltersContext, resources)
+		case gwapiv1.HTTPRouteFilterExtensionRef:
+			t.processExtensionRefHTTPFilter(filter.ExtensionRef, httpFiltersContext, resources)
+		default:
+			t.processUnsupportedHTTPFilter(string(filter.Type), httpFiltersContext)
+		}
+	}
+
+	return httpFiltersContext
+}
+
+// ProcessGRPCFilters translates gateway api grpc filters to IRs.
+func (t *Translator) ProcessGRPCFilters(parentRef *RouteParentContext,
+	route RouteContext,
+	filters []v1alpha2.GRPCRouteFilter,
+	resources *Resources) *HTTPFiltersContext {
+	httpFiltersContext := &HTTPFiltersContext{
+		ParentRef: parentRef,
+		Route:     route,
+
+		HTTPFilterIR: &HTTPFilterIR{},
+	}
+	for i := range filters {
+		filter := filters[i]
+		// If an invalid filter type has been configured then skip processing any more filters
+		if httpFiltersContext.DirectResponse != nil {
+			break
+		}
+		if err := ValidateGRPCRouteFilter(&filter); err != nil {
+			t.processInvalidHTTPFilter(string(filter.Type), httpFiltersContext, err)
+			break
+		}
+
+		switch filter.Type {
+		case v1alpha2.GRPCRouteFilterRequestHeaderModifier:
+			t.processRequestHeaderModifierFilter(filter.RequestHeaderModifier, httpFiltersContext)
+		case v1alpha2.GRPCRouteFilterResponseHeaderModifier:
+			t.processResponseHeaderModifierFilter(filter.ResponseHeaderModifier, httpFiltersContext)
+		case v1alpha2.GRPCRouteFilterRequestMirror:
+			t.processRequestMirrorFilter(i, filter.RequestMirror, httpFiltersContext, resources)
+		case v1alpha2.GRPCRouteFilterExtensionRef:
+			t.processExtensionRefHTTPFilter(filter.ExtensionRef, httpFiltersContext, resources)
+		default:
+			t.processUnsupportedHTTPFilter(string(filter.Type), httpFiltersContext)
+		}
+	}
+
+	return httpFiltersContext
+}
+
+func (t *Translator) processURLRewriteFilter(
+	rewrite *gwapiv1.HTTPURLRewriteFilter,
+	filterContext *HTTPFiltersContext) {
+	if filterContext.URLRewrite != nil {
+		filterContext.ParentRef.SetCondition(filterContext.Route,
+			gwapiv1.RouteConditionAccepted,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonUnsupportedValue,
+			"Cannot configure multiple urlRewrite filters for a single HTTPRouteRule",
+		)
+		return
+	}
+
+	if rewrite == nil {
+		return
+	}
+
+	newURLRewrite := &ir.URLRewrite{}
+
+	if rewrite.Hostname != nil {
+		if err := t.validateHostname(string(*rewrite.Hostname)); err != nil {
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				err.Error(),
+			)
+			return
+		}
+		redirectHost := string(*rewrite.Hostname)
+		newURLRewrite.Hostname = &redirectHost
+	}
+
+	if rewrite.Path != nil {
+		switch rewrite.Path.Type {
+		case gwapiv1.FullPathHTTPPathModifier:
+			if rewrite.Path.ReplacePrefixMatch != nil {
+				errMsg := "ReplacePrefixMatch cannot be set when rewrite path type is \"ReplaceFullPath\""
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					errMsg,
+				)
+				return
+			}
+			if rewrite.Path.ReplaceFullPath == nil {
+				errMsg := "ReplaceFullPath must be set when rewrite path type is \"ReplaceFullPath\""
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					errMsg,
+				)
+				return
+			}
+			if rewrite.Path.ReplaceFullPath != nil {
+				newURLRewrite.Path = &ir.HTTPPathModifier{
+					FullReplace: rewrite.Path.ReplaceFullPath,
+				}
+			}
+		case gwapiv1.PrefixMatchHTTPPathModifier:
+			if rewrite.Path.ReplaceFullPath != nil {
+				errMsg := "ReplaceFullPath cannot be set when rewrite path type is \"ReplacePrefixMatch\""
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					errMsg,
+				)
+				return
+			}
+			if rewrite.Path.ReplacePrefixMatch == nil {
+				errMsg := "ReplacePrefixMatch must be set when rewrite path type is \"ReplacePrefixMatch\""
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					errMsg,
+				)
+				return
+			}
+			if rewrite.Path.ReplacePrefixMatch != nil {
+				newURLRewrite.Path = &ir.HTTPPathModifier{
+					PrefixMatchReplace: rewrite.Path.ReplacePrefixMatch,
+				}
+			}
+		default:
+			errMsg := fmt.Sprintf("Rewrite path type: %s is invalid, only \"ReplaceFullPath\" and \"ReplacePrefixMatch\" are supported", rewrite.Path.Type)
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				errMsg,
+			)
+			return
+		}
+	}
+
+	filterContext.URLRewrite = newURLRewrite
+}
+
+func (t *Translator) processRedirectFilter(
+	redirect *gwapiv1.HTTPRequestRedirectFilter,
+	filterContext *HTTPFiltersContext) {
+	// Can't have two redirects for the same route
+	if filterContext.RedirectResponse != nil {
+		filterContext.ParentRef.SetCondition(filterContext.Route,
+			gwapiv1.RouteConditionAccepted,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonUnsupportedValue,
+			"Cannot configure multiple requestRedirect filters for a single HTTPRouteRule",
+		)
+		return
+	}
+
+	if redirect == nil {
+		return
+	}
+
+	redir := &ir.Redirect{}
+	if redirect.Scheme != nil {
+		// Note that gateway API may support additional schemes in the future, but unknown values
+		// must result in an UnsupportedValue status
+		if *redirect.Scheme == "http" || *redirect.Scheme == "https" {
+			redir.Scheme = redirect.Scheme
+		} else {
+			errMsg := fmt.Sprintf("Scheme: %s is unsupported, only 'https' and 'http' are supported", *redirect.Scheme)
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				errMsg,
+			)
+			return
+		}
+	}
+
+	if redirect.Hostname != nil {
+		if err := t.validateHostname(string(*redirect.Hostname)); err != nil {
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				err.Error(),
+			)
+		} else {
+			redirectHost := string(*redirect.Hostname)
+			redir.Hostname = &redirectHost
+		}
+	}
+
+	if redirect.Path != nil {
+		switch redirect.Path.Type {
+		case gwapiv1.FullPathHTTPPathModifier:
+			if redirect.Path.ReplaceFullPath != nil {
+				redir.Path = &ir.HTTPPathModifier{
+					FullReplace: redirect.Path.ReplaceFullPath,
+				}
+			}
+		case gwapiv1.PrefixMatchHTTPPathModifier:
+			if redirect.Path.ReplacePrefixMatch != nil {
+				redir.Path = &ir.HTTPPathModifier{
+					PrefixMatchReplace: redirect.Path.ReplacePrefixMatch,
+				}
+			}
+		default:
+			errMsg := fmt.Sprintf("Redirect path type: %s is invalid, only \"ReplaceFullPath\" and \"ReplacePrefixMatch\" are supported", redirect.Path.Type)
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				errMsg,
+			)
+			return
+		}
+	}
+
+	if redirect.StatusCode != nil {
+		redirectCode := int32(*redirect.StatusCode)
+		// Envoy supports 302, 303, 307, and 308, but gateway API only includes 301 and 302
+		if redirectCode == 301 || redirectCode == 302 {
+			redir.StatusCode = &redirectCode
+		} else {
+			errMsg := fmt.Sprintf("Status code %d is invalid, only 302 and 301 are supported", redirectCode)
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				errMsg,
+			)
+			return
+		}
+	}
+
+	if redirect.Port != nil {
+		redirectPort := uint32(*redirect.Port)
+		redir.Port = &redirectPort
+	}
+
+	filterContext.RedirectResponse = redir
+}
+
+func (t *Translator) processRequestHeaderModifierFilter(
+	headerModifier *gwapiv1.HTTPHeaderFilter,
+	filterContext *HTTPFiltersContext) {
+	// Make sure the header modifier config actually exists
+	if headerModifier == nil {
+		return
+	}
+	emptyFilterConfig := true // keep track of whether the provided config is empty or not
+
+	// Add request headers
+	if headersToAdd := headerModifier.Add; headersToAdd != nil {
+		if len(headersToAdd) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, addHeader := range headersToAdd {
+			emptyFilterConfig = false
+			if addHeader.Name == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"RequestHeaderModifier Filter cannot add a header with an empty name",
+				)
+				// try to process the rest of the headers and produce a valid config.
+				continue
+			}
+			// Per Gateway API specification on HTTPHeaderName, : and / are invalid characters in header names
+			if strings.Contains(string(addHeader.Name), "/") || strings.Contains(string(addHeader.Name), ":") {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					fmt.Sprintf("RequestHeaderModifier Filter cannot set headers with a '/' or ':' character in them. Header: %q", string(addHeader.Name)),
+				)
+				continue
+			}
+			// Check if the header is a duplicate
+			headerKey := string(addHeader.Name)
+			canAddHeader := true
+			for _, h := range filterContext.AddRequestHeaders {
+				if strings.EqualFold(h.Name, headerKey) {
+					canAddHeader = false
+					break
+				}
+			}
+
+			if !canAddHeader {
+				continue
+			}
+
+			newHeader := ir.AddHeader{
+				Name:   headerKey,
+				Append: true,
+				Value:  addHeader.Value,
+			}
+
+			filterContext.AddRequestHeaders = append(filterContext.AddRequestHeaders, newHeader)
+		}
+	}
+
+	// Set headers
+	if headersToSet := headerModifier.Set; headersToSet != nil {
+		if len(headersToSet) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, setHeader := range headersToSet {
+
+			if setHeader.Name == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"RequestHeaderModifier Filter cannot set a header with an empty name",
+				)
+				continue
+			}
+			// Per Gateway API specification on HTTPHeaderName, : and / are invalid characters in header names
+			if strings.Contains(string(setHeader.Name), "/") || strings.Contains(string(setHeader.Name), ":") {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					fmt.Sprintf("RequestHeaderModifier Filter cannot set headers with a '/' or ':' character in them. Header: '%s'", string(setHeader.Name)),
+				)
+				continue
+			}
+
+			// Check if the header to be set has already been configured
+			headerKey := string(setHeader.Name)
+			canAddHeader := true
+			for _, h := range filterContext.AddRequestHeaders {
+				if strings.EqualFold(h.Name, headerKey) {
+					canAddHeader = false
+					break
+				}
+			}
+			if !canAddHeader {
+				continue
+			}
+			newHeader := ir.AddHeader{
+				Name:   string(setHeader.Name),
+				Append: false,
+				Value:  setHeader.Value,
+			}
+
+			filterContext.AddRequestHeaders = append(filterContext.AddRequestHeaders, newHeader)
+		}
+	}
+
+	// Remove request headers
+	// As far as Envoy is concerned, it is ok to configure a header to be added/set and also in the list of
+	// headers to remove. It will remove the original header if present and then add/set the header after.
+	if headersToRemove := headerModifier.Remove; headersToRemove != nil {
+		if len(headersToRemove) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, removedHeader := range headersToRemove {
+			if removedHeader == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"RequestHeaderModifier Filter cannot remove a header with an empty name",
+				)
+				continue
+			}
+
+			canRemHeader := true
+			for _, h := range filterContext.RemoveRequestHeaders {
+				if strings.EqualFold(h, removedHeader) {
+					canRemHeader = false
+					break
+				}
+			}
+			if !canRemHeader {
+				continue
+			}
+
+			filterContext.RemoveRequestHeaders = append(filterContext.RemoveRequestHeaders, removedHeader)
+		}
+	}
+
+	// Update the status if the filter failed to configure any valid headers to add/remove
+	if len(filterContext.AddRequestHeaders) == 0 && len(filterContext.RemoveRequestHeaders) == 0 && !emptyFilterConfig {
+		filterContext.ParentRef.SetCondition(filterContext.Route,
+			gwapiv1.RouteConditionAccepted,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonUnsupportedValue,
+			"RequestHeaderModifier Filter did not provide valid configuration to add/set/remove any headers",
+		)
+	}
+}
+
+func (t *Translator) processResponseHeaderModifierFilter(
+	headerModifier *gwapiv1.HTTPHeaderFilter,
+	filterContext *HTTPFiltersContext) {
+	// Make sure the header modifier config actually exists
+	if headerModifier == nil {
+		return
+	}
+	emptyFilterConfig := true // keep track of whether the provided config is empty or not
+
+	// Add response headers
+	if headersToAdd := headerModifier.Add; headersToAdd != nil {
+		if len(headersToAdd) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, addHeader := range headersToAdd {
+			emptyFilterConfig = false
+			if addHeader.Name == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"ResponseHeaderModifier Filter cannot add a header with an empty name",
+				)
+				// try to process the rest of the headers and produce a valid config.
+				continue
+			}
+			// Per Gateway API specification on HTTPHeaderName, : and / are invalid characters in header names
+			if strings.Contains(string(addHeader.Name), "/") || strings.Contains(string(addHeader.Name), ":") {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					fmt.Sprintf("ResponseHeaderModifier Filter cannot set headers with a '/' or ':' character in them. Header: %q", string(addHeader.Name)),
+				)
+				continue
+			}
+			// Check if the header is a duplicate
+			headerKey := string(addHeader.Name)
+			canAddHeader := true
+			for _, h := range filterContext.AddResponseHeaders {
+				if strings.EqualFold(h.Name, headerKey) {
+					canAddHeader = false
+					break
+				}
+			}
+
+			if !canAddHeader {
+				continue
+			}
+
+			newHeader := ir.AddHeader{
+				Name:   headerKey,
+				Append: true,
+				Value:  addHeader.Value,
+			}
+
+			filterContext.AddResponseHeaders = append(filterContext.AddResponseHeaders, newHeader)
+		}
+	}
+
+	// Set headers
+	if headersToSet := headerModifier.Set; headersToSet != nil {
+		if len(headersToSet) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, setHeader := range headersToSet {
+
+			if setHeader.Name == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"ResponseHeaderModifier Filter cannot set a header with an empty name",
+				)
+				continue
+			}
+			// Per Gateway API specification on HTTPHeaderName, : and / are invalid characters in header names
+			if strings.Contains(string(setHeader.Name), "/") || strings.Contains(string(setHeader.Name), ":") {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					fmt.Sprintf("ResponseHeaderModifier Filter cannot set headers with a '/' or ':' character in them. Header: '%s'", string(setHeader.Name)),
+				)
+				continue
+			}
+
+			// Check if the header to be set has already been configured
+			headerKey := string(setHeader.Name)
+			canAddHeader := true
+			for _, h := range filterContext.AddResponseHeaders {
+				if strings.EqualFold(h.Name, headerKey) {
+					canAddHeader = false
+					break
+				}
+			}
+			if !canAddHeader {
+				continue
+			}
+			newHeader := ir.AddHeader{
+				Name:   string(setHeader.Name),
+				Append: false,
+				Value:  setHeader.Value,
+			}
+
+			filterContext.AddResponseHeaders = append(filterContext.AddResponseHeaders, newHeader)
+		}
+	}
+
+	// Remove response headers
+	// As far as Envoy is concerned, it is ok to configure a header to be added/set and also in the list of
+	// headers to remove. It will remove the original header if present and then add/set the header after.
+	if headersToRemove := headerModifier.Remove; headersToRemove != nil {
+		if len(headersToRemove) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, removedHeader := range headersToRemove {
+			if removedHeader == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"ResponseHeaderModifier Filter cannot remove a header with an empty name",
+				)
+				continue
+			}
+
+			canRemHeader := true
+			for _, h := range filterContext.RemoveResponseHeaders {
+				if strings.EqualFold(h, removedHeader) {
+					canRemHeader = false
+					break
+				}
+			}
+			if !canRemHeader {
+				continue
+			}
+
+			filterContext.RemoveResponseHeaders = append(filterContext.RemoveResponseHeaders, removedHeader)
+
+		}
+	}
+
+	// Update the status if the filter failed to configure any valid headers to add/remove
+	if len(filterContext.AddResponseHeaders) == 0 && len(filterContext.RemoveResponseHeaders) == 0 && !emptyFilterConfig {
+		filterContext.ParentRef.SetCondition(filterContext.Route,
+			gwapiv1.RouteConditionAccepted,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonUnsupportedValue,
+			"ResponseHeaderModifier Filter did not provide valid configuration to add/set/remove any headers",
+		)
+	}
+}
+
+func (t *Translator) processExtensionRefHTTPFilter(extFilter *gwapiv1.LocalObjectReference, filterContext *HTTPFiltersContext, resources *Resources) {
+	// Make sure the config actually exists.
+	if extFilter == nil {
+		return
+	}
+
+	filterNs := filterContext.Route.GetNamespace()
+	// This list of resources will be empty unless an extension is loaded (and introduces resources)
+	for _, res := range resources.ExtensionRefFilters {
+		if res.GetKind() == string(extFilter.Kind) && res.GetName() == string(extFilter.Name) && res.GetNamespace() == filterNs {
+			apiVers := res.GetAPIVersion()
+
+			// To get only the group we cut off the version.
+			// This could be a one liner but just to be safe we check that the APIVersion is properly formatted
+			idx := strings.IndexByte(apiVers, '/')
+			if idx == -1 {
+				errMsg := fmt.Sprintf("Unable to translate APIVersion for Extension Filter: kind: %s, %s/%s", res.GetKind(), filterNs, extFilter.Name)
+				t.processUnresolvedHTTPFilter(errMsg, filterContext)
+				return
+			}
+			group := apiVers[:idx]
+			if group == string(extFilter.Group) {
+				resource := res // Capture loop variable
+				filterContext.ExtensionRefs = append(filterContext.ExtensionRefs, &ir.UnstructuredRef{
+					Object: &resource,
+				})
+				return
+			}
+		}
+	}
+
+	// Matching filter not found, so set negative status condition.
+	errMsg := fmt.Sprintf("Reference %s/%s not found for filter type: %v", filterNs,
+		extFilter.Name, extFilter.Kind)
+	t.processUnresolvedHTTPFilter(errMsg, filterContext)
+}
+
+func (t *Translator) processRequestMirrorFilter(
+	filterIdx int,
+	mirrorFilter *gwapiv1.HTTPRequestMirrorFilter,
+	filterContext *HTTPFiltersContext,
+	resources *Resources) {
+
+	// Make sure the config actually exists
+	if mirrorFilter == nil {
+		return
+	}
+
+	mirrorBackend := mirrorFilter.BackendRef
+
+	// Wrap the filter's BackendObjectReference into a BackendRef so we can use existing tooling to check it
+	weight := int32(1)
+	mirrorBackendRef := gwapiv1.HTTPBackendRef{
+		BackendRef: gwapiv1.BackendRef{
+			BackendObjectReference: mirrorBackend,
+			Weight:                 &weight,
+		},
+	}
+
+	// This sets the status on the HTTPRoute, should the usage be changed so that the status message reflects that the backendRef is from the filter?
+	filterNs := filterContext.Route.GetNamespace()
+	serviceNamespace := NamespaceDerefOr(mirrorBackend.Namespace, filterNs)
+	if !t.validateBackendRef(mirrorBackendRef, filterContext.ParentRef, filterContext.Route,
+		resources, serviceNamespace, KindHTTPRoute) {
+		return
+	}
+
+	ds, _ := t.processDestination(mirrorBackendRef, filterContext.ParentRef, filterContext.Route, resources)
+
+	newMirror := &ir.RouteDestination{
+		Name:     fmt.Sprintf("%s-mirror-%d", irRouteDestinationName(filterContext.Route, filterContext.RuleIdx), filterIdx),
+		Settings: []*ir.DestinationSetting{ds},
+	}
+	filterContext.Mirrors = append(filterContext.Mirrors, newMirror)
+}
+
+func (t *Translator) processUnresolvedHTTPFilter(errMsg string, filterContext *HTTPFiltersContext) {
+	filterContext.ParentRef.SetCondition(filterContext.Route,
+		gwapiv1.RouteConditionResolvedRefs,
+		metav1.ConditionFalse,
+		gwapiv1.RouteReasonBackendNotFound,
+		errMsg,
+	)
+	filterContext.ParentRef.SetCondition(filterContext.Route,
+		gwapiv1.RouteConditionAccepted,
+		metav1.ConditionFalse,
+		gwapiv1.RouteReasonUnsupportedValue,
+		errMsg,
+	)
+	filterContext.DirectResponse = &ir.DirectResponse{
+		Body:       &errMsg,
+		StatusCode: 500,
+	}
+}
+
+func (t *Translator) processUnsupportedHTTPFilter(filterType string, filterContext *HTTPFiltersContext) {
+	errMsg := fmt.Sprintf("Unsupported filter type: %s", filterType)
+	filterContext.ParentRef.SetCondition(filterContext.Route,
+		gwapiv1.RouteConditionAccepted,
+		metav1.ConditionFalse,
+		gwapiv1.RouteReasonUnsupportedValue,
+		errMsg,
+	)
+	filterContext.DirectResponse = &ir.DirectResponse{
+		Body:       &errMsg,
+		StatusCode: 500,
+	}
+}
+
+func (t *Translator) processInvalidHTTPFilter(filterType string, filterContext *HTTPFiltersContext, err error) {
+	errMsg := fmt.Sprintf("Invalid filter %s: %v", filterType, err)
+	filterContext.ParentRef.SetCondition(filterContext.Route,
+		gwapiv1.RouteConditionAccepted,
+		metav1.ConditionFalse,
+		gwapiv1.RouteReasonUnsupportedValue,
+		errMsg,
+	)
+	filterContext.DirectResponse = &ir.DirectResponse{
+		Body:       &errMsg,
+		StatusCode: 500,
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/helpers.go b/adapter/internal/operator/gateway-api/helpers.go
new file mode 100644
index 000000000..279d8bc43
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/helpers.go
@@ -0,0 +1,461 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+const (
+	TCPProtocol = "TCP"
+	UDPProtocol = "UDP"
+	L4Protocol  = "L4"
+	L7Protocol  = "L7"
+)
+
+type protocolPort struct {
+	protocol gwapiv1.ProtocolType
+	port     int32
+}
+
+func GroupPtr(name string) *gwapiv1.Group {
+	group := gwapiv1.Group(name)
+	return &group
+}
+
+func KindPtr(name string) *gwapiv1.Kind {
+	kind := gwapiv1.Kind(name)
+	return &kind
+}
+
+func NamespacePtr(name string) *gwapiv1.Namespace {
+	namespace := gwapiv1.Namespace(name)
+	return &namespace
+}
+
+func FromNamespacesPtr(fromNamespaces gwapiv1.FromNamespaces) *gwapiv1.FromNamespaces {
+	return &fromNamespaces
+}
+
+func SectionNamePtr(name string) *gwapiv1.SectionName {
+	sectionName := gwapiv1.SectionName(name)
+	return &sectionName
+}
+
+func PortNumPtr(val int32) *gwapiv1.PortNumber {
+	portNum := gwapiv1.PortNumber(val)
+	return &portNum
+}
+
+func ObjectNamePtr(val string) *v1alpha2.ObjectName {
+	objectName := v1alpha2.ObjectName(val)
+	return &objectName
+}
+
+var (
+	PathMatchTypeDerefOr       = ptr.Deref[gwapiv1.PathMatchType]
+	GRPCMethodMatchTypeDerefOr = ptr.Deref[v1alpha2.GRPCMethodMatchType]
+	HeaderMatchTypeDerefOr     = ptr.Deref[gwapiv1.HeaderMatchType]
+	QueryParamMatchTypeDerefOr = ptr.Deref[gwapiv1.QueryParamMatchType]
+)
+
+func NamespaceDerefOr(namespace *gwapiv1.Namespace, defaultNamespace string) string {
+	if namespace != nil && *namespace != "" {
+		return string(*namespace)
+	}
+	return defaultNamespace
+}
+
+func GroupDerefOr(group *gwapiv1.Group, defaultGroup string) string {
+	if group != nil && *group != "" {
+		return string(*group)
+	}
+	return defaultGroup
+}
+
+func KindDerefOr(kind *gwapiv1.Kind, defaultKind string) string {
+	if kind != nil && *kind != "" {
+		return string(*kind)
+	}
+	return defaultKind
+}
+
+// IsRefToGateway returns whether the provided parent ref is a reference
+// to a Gateway with the given namespace/name, irrespective of whether a
+// section/listener name has been specified (i.e. a parent ref to a listener
+// on the specified gateway will return "true").
+func IsRefToGateway(parentRef gwapiv1.ParentReference, gateway types.NamespacedName) bool {
+	if parentRef.Group != nil && string(*parentRef.Group) != gwapiv1.GroupName {
+		return false
+	}
+
+	if parentRef.Kind != nil && string(*parentRef.Kind) != KindGateway {
+		return false
+	}
+
+	if parentRef.Namespace != nil && string(*parentRef.Namespace) != gateway.Namespace {
+		return false
+	}
+
+	return string(parentRef.Name) == gateway.Name
+}
+
+// GetReferencedListeners returns whether a given parent ref references a Gateway
+// in the given list, and if so, a list of the Listeners within that Gateway that
+// are included by the parent ref (either one specific Listener, or all Listeners
+// in the Gateway, depending on whether section name is specified or not).
+func GetReferencedListeners(parentRef gwapiv1.ParentReference, gateways []*GatewayContext) (bool, []*ListenerContext) {
+	var selectsGateway bool
+	var referencedListeners []*ListenerContext
+
+	for _, gateway := range gateways {
+		if !IsRefToGateway(parentRef, utils.NamespacedName(gateway)) {
+			continue
+		}
+
+		selectsGateway = true
+
+		// The parentRef may be to the entire Gateway, or to a specific listener.
+		for _, listener := range gateway.listeners {
+			if (parentRef.SectionName == nil || *parentRef.SectionName == listener.Name) && (parentRef.Port == nil || *parentRef.Port == listener.Port) {
+				referencedListeners = append(referencedListeners, listener)
+			}
+		}
+	}
+
+	return selectsGateway, referencedListeners
+}
+
+// HasReadyListener returns true if at least one Listener in the
+// provided list has a condition of "Ready: true", and false otherwise.
+func HasReadyListener(listeners []*ListenerContext) bool {
+	for _, listener := range listeners {
+		if listener.IsReady() {
+			return true
+		}
+	}
+	return false
+}
+
+// ValidateHTTPRouteFilter validates the provided filter within HTTPRoute.
+func ValidateHTTPRouteFilter(filter *gwapiv1.HTTPRouteFilter) error {
+	switch {
+	case filter == nil:
+		return errors.New("filter is nil")
+	case filter.Type == gwapiv1.HTTPRouteFilterRequestMirror ||
+		filter.Type == gwapiv1.HTTPRouteFilterURLRewrite ||
+		filter.Type == gwapiv1.HTTPRouteFilterRequestRedirect ||
+		filter.Type == gwapiv1.HTTPRouteFilterRequestHeaderModifier ||
+		filter.Type == gwapiv1.HTTPRouteFilterResponseHeaderModifier:
+		return nil
+	case filter.Type == gwapiv1.HTTPRouteFilterExtensionRef:
+		switch {
+		case filter.ExtensionRef == nil:
+			return errors.New("extensionRef field must be specified for an extended filter")
+		}
+	default:
+		return fmt.Errorf("unsupported filter type %v", filter.Type)
+	}
+	return nil
+}
+
+// ValidateGRPCRouteFilter validates the provided filter within GRPCRoute.
+func ValidateGRPCRouteFilter(filter *v1alpha2.GRPCRouteFilter, extGKs ...schema.GroupKind) error {
+	switch {
+	case filter == nil:
+		return errors.New("filter is nil")
+	case filter.Type == v1alpha2.GRPCRouteFilterRequestMirror ||
+		filter.Type == v1alpha2.GRPCRouteFilterRequestHeaderModifier ||
+		filter.Type == v1alpha2.GRPCRouteFilterResponseHeaderModifier:
+		return nil
+	case filter.Type == v1alpha2.GRPCRouteFilterExtensionRef:
+		switch {
+		case filter.ExtensionRef == nil:
+			return errors.New("extensionRef field must be specified for an extended filter")
+		default:
+			for _, gk := range extGKs {
+				if filter.ExtensionRef.Group == gwapiv1.Group(gk.Group) &&
+					filter.ExtensionRef.Kind == gwapiv1.Kind(gk.Kind) {
+					return nil
+				}
+			}
+			return fmt.Errorf("unknown kind %s/%s", string(filter.ExtensionRef.Group), string(filter.ExtensionRef.Kind))
+		}
+	default:
+		return fmt.Errorf("unsupported filter type %v", filter.Type)
+	}
+}
+
+// GatewayOwnerLabels returns the Gateway Owner labels using
+// the provided namespace and name as the values.
+func GatewayOwnerLabels(namespace, name string) map[string]string {
+	return map[string]string{
+		OwningGatewayNamespaceLabel: namespace,
+		OwningGatewayNameLabel:      name,
+	}
+}
+
+// GatewayClassOwnerLabel returns the GatewayCLass Owner label using
+// the provided name as the value.
+func GatewayClassOwnerLabel(name string) map[string]string {
+	return map[string]string{OwningGatewayClassLabel: name}
+}
+
+// servicePortToContainerPort translates a service port into an ephemeral
+// container port.
+func servicePortToContainerPort(servicePort int32) int32 {
+	// If the service port is a privileged port (1-1023)
+	// add a constant to the value converting it into an ephemeral port.
+	// This allows the container to bind to the port without needing a
+	// CAP_NET_BIND_SERVICE capability.
+	if servicePort < minEphemeralPort {
+		return servicePort + wellKnownPortShift
+	}
+	return servicePort
+}
+
+// computeHosts returns a list of the intersecting hostnames between the route
+// and the listener.
+func computeHosts(routeHostnames []string, listenerHostname *gwapiv1.Hostname) []string {
+	var listenerHostnameVal string
+	if listenerHostname != nil {
+		listenerHostnameVal = string(*listenerHostname)
+	}
+
+	// No route hostnames specified: use the listener hostname if specified,
+	// or else match all hostnames.
+	if len(routeHostnames) == 0 {
+		if len(listenerHostnameVal) > 0 {
+			return []string{listenerHostnameVal}
+		}
+
+		return []string{"*"}
+	}
+
+	var hostnames []string
+
+	for i := range routeHostnames {
+		routeHostname := routeHostnames[i]
+
+		// TODO ensure routeHostname is a valid hostname
+
+		switch {
+		// No listener hostname: use the route hostname.
+		case len(listenerHostnameVal) == 0:
+			hostnames = append(hostnames, routeHostname)
+
+		// Listener hostname matches the route hostname: use it.
+		case listenerHostnameVal == routeHostname:
+			hostnames = append(hostnames, routeHostname)
+
+		// Listener has a wildcard hostname: check if the route hostname matches.
+		case strings.HasPrefix(listenerHostnameVal, "*"):
+			if hostnameMatchesWildcardHostname(routeHostname, listenerHostnameVal) {
+				hostnames = append(hostnames, routeHostname)
+			}
+
+		// Route has a wildcard hostname: check if the listener hostname matches.
+		case strings.HasPrefix(routeHostname, "*"):
+			if hostnameMatchesWildcardHostname(listenerHostnameVal, routeHostname) {
+				hostnames = append(hostnames, listenerHostnameVal)
+			}
+
+		}
+	}
+
+	return hostnames
+}
+
+// hostnameMatchesWildcardHostname returns true if hostname has the non-wildcard
+// portion of wildcardHostname as a suffix, plus at least one DNS label matching the
+// wildcard.
+func hostnameMatchesWildcardHostname(hostname, wildcardHostname string) bool {
+	if !strings.HasSuffix(hostname, strings.TrimPrefix(wildcardHostname, "*")) {
+		return false
+	}
+
+	wildcardMatch := strings.TrimSuffix(hostname, strings.TrimPrefix(wildcardHostname, "*"))
+	return len(wildcardMatch) > 0
+}
+
+func containsPort(ports []*protocolPort, port *protocolPort) bool {
+	for _, protocolPort := range ports {
+		curProtocol, curLevel := layer4Protocol(protocolPort)
+		myProtocol, myLevel := layer4Protocol(port)
+		if protocolPort.port == port.port && (curProtocol == myProtocol && curLevel == myLevel) {
+			return true
+		}
+	}
+	return false
+}
+
+// layer4Protocol returns listener L4 protocol and listen protocol level
+func layer4Protocol(protocolPort *protocolPort) (string, string) {
+	switch protocolPort.protocol {
+	case gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType, gwapiv1.TLSProtocolType:
+		return TCPProtocol, L7Protocol
+	case gwapiv1.TCPProtocolType:
+		return TCPProtocol, L4Protocol
+	default:
+		return UDPProtocol, L4Protocol
+	}
+}
+
+type crossNamespaceFrom struct {
+	group     string
+	kind      string
+	namespace string
+}
+
+type crossNamespaceTo struct {
+	group     string
+	kind      string
+	namespace string
+	name      string
+}
+
+func irStringKey(gatewayNs, gatewayName string) string {
+	if len(gatewayNs) > 5 {
+		gatewayNs = gatewayNs[:5]
+	}
+	return fmt.Sprintf("%s/%s", gatewayNs, gatewayName)
+}
+
+func irHTTPListenerName(listener *ListenerContext) string {
+	return fmt.Sprintf("%s/%s/%s", listener.gateway.Namespace, listener.gateway.Name, listener.Name)
+}
+
+func irTLSListenerName(listener *ListenerContext, tlsRoute *TLSRouteContext) string {
+	return fmt.Sprintf("%s/%s/%s/%s", listener.gateway.Namespace, listener.gateway.Name, listener.Name, tlsRoute.Name)
+}
+
+func irTCPListenerName(listener *ListenerContext, tcpRoute *TCPRouteContext) string {
+	return fmt.Sprintf("%s/%s/%s/%s", listener.gateway.Namespace, listener.gateway.Name, listener.Name, tcpRoute.Name)
+}
+
+func irUDPListenerName(listener *ListenerContext, udpRoute *UDPRouteContext) string {
+	return fmt.Sprintf("%s/%s/%s/%s", listener.gateway.Namespace, listener.gateway.Name, listener.Name, udpRoute.Name)
+}
+
+func irRoutePrefix(route RouteContext) string {
+	// add a "/" at the end of the prefix to prevent mismatching routes with the
+	// same prefix. For example, route prefix "/foo/" should not match a route "/foobar".
+	return fmt.Sprintf("%s/%s/%s/", strings.ToLower(string(GetRouteType(route))), route.GetNamespace(), route.GetName())
+}
+
+func irRouteName(route RouteContext, ruleIdx, matchIdx int) string {
+	return fmt.Sprintf("%srule/%d/match/%d", irRoutePrefix(route), ruleIdx, matchIdx)
+}
+
+func irRouteDestinationName(route RouteContext, ruleIdx int) string {
+	return fmt.Sprintf("%srule/%d", irRoutePrefix(route), ruleIdx)
+}
+
+func irTLSConfigs(tlsSecrets []*v1.Secret) *ir.TLSConfig {
+	if len(tlsSecrets) == 0 {
+		return nil
+	}
+
+	tlsListenerConfigs := &ir.TLSConfig{
+		Certificates: make([]ir.TLSCertificate, len(tlsSecrets)),
+	}
+	for i, tlsSecret := range tlsSecrets {
+		tlsListenerConfigs.Certificates[i] = ir.TLSCertificate{
+			Name:              irTLSListenerConfigName(tlsSecret),
+			ServerCertificate: tlsSecret.Data[v1.TLSCertKey],
+			PrivateKey:        tlsSecret.Data[v1.TLSPrivateKeyKey],
+		}
+	}
+	return tlsListenerConfigs
+}
+
+func irTLSListenerConfigName(secret *v1.Secret) string {
+	return fmt.Sprintf("%s/%s", secret.Namespace, secret.Name)
+}
+
+func protocolSliceToStringSlice(protocols []gwapiv1.ProtocolType) []string {
+	var protocolStrings []string
+	for _, protocol := range protocols {
+		protocolStrings = append(protocolStrings, string(protocol))
+	}
+	return protocolStrings
+}
+
+// func getAncestorRefForPolicy(gatewayNN types.NamespacedName, sectionName *v1alpha2.SectionName) v1alpha2.ParentReference {
+// 	return v1alpha2.ParentReference{
+// 		Group:       GroupPtr(gwapiv1.GroupName),
+// 		Kind:        KindPtr(KindGateway),
+// 		Namespace:   NamespacePtr(gatewayNN.Namespace),
+// 		Name:        gwapiv1.ObjectName(gatewayNN.Name),
+// 		SectionName: sectionName,
+// 	}
+// }
+
+// type policyTargetRouteKey struct {
+// 	Kind      string
+// 	Namespace string
+// 	Name      string
+// }
+
+// type policyRouteTargetContext struct {
+// 	RouteContext
+// 	attached bool
+// }
+
+// type policyGatewayTargetContext struct {
+// 	*GatewayContext
+// 	attached bool
+// }
+
+// listenersWithSameHTTPPort returns a list of the names of all other HTTP listeners
+// that would share the same filter chain as the provided listener when translated
+// to XDS
+func listenersWithSameHTTPPort(xdsIR *ir.Xds, listener *ir.HTTPListener) []string {
+	// if TLS is enabled, the listener would have its own filterChain in Envoy, so
+	// no conflicts are possible
+	if listener.TLS != nil {
+		return nil
+	}
+	res := []string{}
+	for _, http := range xdsIR.HTTP {
+		if http == listener {
+			continue
+		}
+		// Non-TLS listeners can be distinguished by their ports
+		if http.Port == listener.Port {
+			res = append(res, http.Name)
+		}
+	}
+	return res
+}
diff --git a/adapter/internal/operator/gateway-api/helpers_v1alpha2.go b/adapter/internal/operator/gateway-api/helpers_v1alpha2.go
new file mode 100644
index 000000000..c59a7f4f3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/helpers_v1alpha2.go
@@ -0,0 +1,205 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// TODO: [gwapiv1a2-gwapiv1]
+// This file can be removed once TLSRoute graduates to gwapiv1.
+
+func GroupPtrV1Alpha2(group string) *gwapiv1a2.Group {
+	gwGroup := gwapiv1a2.Group(group)
+	return &gwGroup
+}
+
+func KindPtrV1Alpha2(kind string) *gwapiv1a2.Kind {
+	gwKind := gwapiv1a2.Kind(kind)
+	return &gwKind
+}
+
+func NamespacePtrV1Alpha2(namespace string) *gwapiv1a2.Namespace {
+	gwNamespace := gwapiv1a2.Namespace(namespace)
+	return &gwNamespace
+}
+
+func SectionNamePtrV1Alpha2(sectionName string) *gwapiv1a2.SectionName {
+	gwSectionName := gwapiv1a2.SectionName(sectionName)
+	return &gwSectionName
+}
+
+func PortNumPtrV1Alpha2(port int) *gwapiv1a2.PortNumber {
+	pn := gwapiv1a2.PortNumber(port)
+	return &pn
+}
+
+func UpgradeParentReferences(old []gwapiv1a2.ParentReference) []gwapiv1.ParentReference {
+	newParentReferences := make([]gwapiv1.ParentReference, len(old))
+	for i, o := range old {
+		newParentReferences[i] = UpgradeParentReference(o)
+	}
+	return newParentReferences
+}
+
+// UpgradeParentReference converts gwapiv1a2.ParentReference to gwapiv1.ParentReference
+func UpgradeParentReference(old gwapiv1a2.ParentReference) gwapiv1.ParentReference {
+	upgraded := gwapiv1.ParentReference{}
+
+	if old.Group != nil {
+		upgraded.Group = GroupPtr(string(*old.Group))
+	}
+
+	if old.Kind != nil {
+		upgraded.Kind = KindPtr(string(*old.Kind))
+	}
+
+	if old.Namespace != nil {
+		upgraded.Namespace = NamespacePtr(string(*old.Namespace))
+	}
+
+	upgraded.Name = old.Name
+
+	if old.SectionName != nil {
+		upgraded.SectionName = SectionNamePtr(string(*old.SectionName))
+	}
+
+	if old.Port != nil {
+		upgraded.Port = PortNumPtr(int32(*old.Port))
+	}
+
+	return upgraded
+}
+
+func DowngradeParentReference(old gwapiv1.ParentReference) gwapiv1a2.ParentReference {
+	downgraded := gwapiv1a2.ParentReference{}
+
+	if old.Group != nil {
+		downgraded.Group = GroupPtrV1Alpha2(string(*old.Group))
+	}
+
+	if old.Kind != nil {
+		downgraded.Kind = KindPtrV1Alpha2(string(*old.Kind))
+	}
+
+	if old.Namespace != nil {
+		downgraded.Namespace = NamespacePtrV1Alpha2(string(*old.Namespace))
+	}
+
+	downgraded.Name = old.Name
+
+	if old.SectionName != nil {
+		downgraded.SectionName = SectionNamePtrV1Alpha2(string(*old.SectionName))
+	}
+
+	if old.Port != nil {
+		downgraded.Port = PortNumPtrV1Alpha2(int(*old.Port))
+	}
+
+	return downgraded
+}
+
+func UpgradeRouteParentStatuses(routeParentStatuses []gwapiv1a2.RouteParentStatus) []gwapiv1.RouteParentStatus {
+	var res []gwapiv1.RouteParentStatus
+
+	for _, rps := range routeParentStatuses {
+		res = append(res, gwapiv1.RouteParentStatus{
+			ParentRef:      UpgradeParentReference(rps.ParentRef),
+			ControllerName: rps.ControllerName,
+			Conditions:     rps.Conditions,
+		})
+	}
+
+	return res
+}
+
+func DowngradeRouteParentStatuses(routeParentStatuses []gwapiv1.RouteParentStatus) []gwapiv1a2.RouteParentStatus {
+	var res []gwapiv1a2.RouteParentStatus
+
+	for _, rps := range routeParentStatuses {
+		res = append(res, gwapiv1a2.RouteParentStatus{
+			ParentRef:      DowngradeParentReference(rps.ParentRef),
+			ControllerName: rps.ControllerName,
+			Conditions:     rps.Conditions,
+		})
+	}
+
+	return res
+}
+
+// UpgradeBackendRef converts gwapiv1a2.BackendRef to gwapiv1.BackendRef
+func UpgradeBackendRef(old gwapiv1a2.BackendRef) gwapiv1.BackendRef {
+	upgraded := gwapiv1.BackendRef{}
+
+	if old.Group != nil {
+		upgraded.Group = GroupPtr(string(*old.Group))
+	}
+
+	if old.Kind != nil {
+		upgraded.Kind = KindPtr(string(*old.Kind))
+	}
+
+	if old.Namespace != nil {
+		upgraded.Namespace = NamespacePtr(string(*old.Namespace))
+	}
+
+	upgraded.Name = old.Name
+
+	if old.Port != nil {
+		upgraded.Port = PortNumPtr(int32(*old.Port))
+	}
+
+	return upgraded
+}
+
+func DowngradeBackendRef(old gwapiv1.BackendRef) gwapiv1a2.BackendRef {
+	downgraded := gwapiv1a2.BackendRef{}
+
+	if old.Group != nil {
+		downgraded.Group = GroupPtrV1Alpha2(string(*old.Group))
+	}
+
+	if old.Kind != nil {
+		downgraded.Kind = KindPtrV1Alpha2(string(*old.Kind))
+	}
+
+	if old.Namespace != nil {
+		downgraded.Namespace = NamespacePtrV1Alpha2(string(*old.Namespace))
+	}
+
+	downgraded.Name = old.Name
+
+	if old.Port != nil {
+		downgraded.Port = PortNumPtrV1Alpha2(int(*old.Port))
+	}
+
+	return downgraded
+}
+
+func NamespaceDerefOrAlpha(namespace *gwapiv1a2.Namespace, defaultNamespace string) string {
+	if namespace != nil && *namespace != "" {
+		return string(*namespace)
+	}
+	return defaultNamespace
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
new file mode 100644
index 000000000..de1057994
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
@@ -0,0 +1,135 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/config"
+	appsv1 "k8s.io/api/apps/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// ResourceRender renders Kubernetes infrastructure resources
+// based on Infra IR resources.
+type ResourceRender interface {
+	Name() string
+	ServiceAccount() (*corev1.ServiceAccount, error)
+	Service() (*corev1.Service, error)
+	ConfigMap() (*corev1.ConfigMap, error)
+	Deployment() (*appsv1.Deployment, error)
+	HorizontalPodAutoscaler() (*autoscalingv2.HorizontalPodAutoscaler, error)
+}
+
+// Infra manages the creation and deletion of Kubernetes infrastructure
+// based on Infra IR resources.
+type Infra struct {
+	// Namespace is the Namespace used for managed infra.
+	Namespace string
+
+	// Client wrap k8s client.
+	Client *InfraClient
+}
+
+// NewInfra returns a new Infra.
+func NewInfra(cli client.Client) *Infra {
+	conf := config.ReadConfigs()
+	return &Infra{
+		Namespace: conf.Envoy.Namespace,
+		Client:    New(cli),
+	}
+}
+
+// createOrUpdate creates a ServiceAccount/ConfigMap/Deployment/Service in the kube api server based on the
+// provided ResourceRender, if it doesn't exist and updates it if it does.
+func (i *Infra) createOrUpdate(ctx context.Context, r ResourceRender) error {
+
+	// certs, err := crypto.GenerateCerts()
+	// if err != nil {
+	// 	return fmt.Errorf("failed to generate certificates: %w", err)
+	// }
+	// secrets, err := gatewayapi.CreateOrUpdateSecrets(ctx, i.Client.Client, gatewayapi.CertsToSecret(i.Namespace, certs), true)
+
+	// if err != nil {
+	// 	if errors.Is(err, gatewayapi.ErrSecretExists) {
+	// 		loggers.LoggerAPKOperator.Info(err.Error())
+	// 	} else {
+	// 		return fmt.Errorf("failed to create or update secrets: %w", err)
+	// 	}
+	// } else {
+	// 	for i := range secrets {
+	// 		s := secrets[i]
+	// 		loggers.LoggerAPKOperator.Info("created secret", "namespace", s.Namespace, "name", s.Name)
+	// 	}
+	// }
+
+	if err := i.createOrUpdateServiceAccount(ctx, r); err != nil {
+		return fmt.Errorf("failed to create or update serviceaccount %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	// if err := i.createOrUpdateConfigMap(ctx, r); err != nil {
+	// 	return fmt.Errorf("failed to create or update configmap %s/%s: %w", i.Namespace, r.Name(), err)
+	// }
+
+	if err := i.createOrUpdateDeployment(ctx, r); err != nil {
+		return fmt.Errorf("failed to create or update deployment %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.createOrUpdateService(ctx, r); err != nil {
+		return fmt.Errorf("failed to create or update service %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.createOrUpdateHPA(ctx, r); err != nil {
+		return fmt.Errorf("failed to create or update hpa %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	return nil
+}
+
+// delete deletes the ServiceAccount/ConfigMap/Deployment/Service in the kube api server, if it exists.
+func (i *Infra) delete(ctx context.Context, r ResourceRender) error {
+	if err := i.deleteServiceAccount(ctx, r); err != nil {
+		return fmt.Errorf("failed to delete serviceaccount %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.deleteConfigMap(ctx, r); err != nil {
+		return fmt.Errorf("failed to delete configmap %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.deleteDeployment(ctx, r); err != nil {
+		return fmt.Errorf("failed to delete deployment %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.deleteService(ctx, r); err != nil {
+		return fmt.Errorf("failed to delete service %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.deleteHPA(ctx, r); err != nil {
+		return fmt.Errorf("failed to delete hpa %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_client.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_client.go
new file mode 100644
index 000000000..afe78efc4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_client.go
@@ -0,0 +1,89 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+type InfraClient struct {
+	client.Client
+}
+
+func New(cli client.Client) *InfraClient {
+	return &InfraClient{
+		Client: cli,
+	}
+}
+
+func (cli *InfraClient) CreateOrUpdate(ctx context.Context, key client.ObjectKey, current client.Object, specific client.Object, updateChecker func() bool) error {
+	return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		if err := cli.Client.Get(ctx, key, current); err != nil {
+			loggers.LoggerAPI.Debugf("Error while getting resource %+v : %v", key, err)
+			if kerrors.IsNotFound(err) {
+				loggers.LoggerAPI.Infof("Creating a new resource %+v", key)
+				// Create if it does not exist.
+				if err := cli.Client.Create(ctx, specific); err != nil {
+					return fmt.Errorf("for Create: %w", err)
+				}
+			}
+		} else {
+			// Since the client.Object does not have a specific Spec field to compare
+			// just perform an update for now.
+			if updateChecker() {
+				specific.SetUID(current.GetUID())
+				if err := cli.Client.Update(ctx, specific); err != nil {
+					return fmt.Errorf("for Update: %w", err)
+				}
+			}
+		}
+
+		return nil
+	})
+}
+
+func (cli *InfraClient) Delete(ctx context.Context, object client.Object) error {
+	if err := cli.Client.Delete(ctx, object); err != nil {
+		if kerrors.IsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+
+	return nil
+}
+
+// GetUID retrieves the uid of one resource.
+func (cli *InfraClient) GetUID(ctx context.Context, key client.ObjectKey, current client.Object) (types.UID, error) {
+	if err := cli.Client.Get(ctx, key, current); err != nil {
+		return "", err
+	}
+	return current.GetUID(), nil
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_resource.go
new file mode 100644
index 000000000..ee11d8530
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_resource.go
@@ -0,0 +1,209 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	appsv1 "k8s.io/api/apps/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// createOrUpdateServiceAccount creates a ServiceAccount in the kube api server based on the
+// provided ResourceRender, if it doesn't exist and updates it if it does.
+func (i *Infra) createOrUpdateServiceAccount(ctx context.Context, r ResourceRender) error {
+	sa, err := r.ServiceAccount()
+	if err != nil {
+		return err
+	}
+
+	current := &corev1.ServiceAccount{}
+	key := utils.NamespacedName(sa)
+
+	return i.Client.CreateOrUpdate(ctx, key, current, sa, func() bool {
+		// the service account never changed, does not need to update
+		// fixes https://github.com/envoyproxy/gateway/issues/1604
+		return false
+	})
+}
+
+// // createOrUpdateConfigMap creates a ConfigMap in the Kube api server based on the provided
+// // ResourceRender, if it doesn't exist and updates it if it does.
+// func (i *Infra) createOrUpdateConfigMap(ctx context.Context, r ResourceRender) error {
+// 	cm, err := r.ConfigMap()
+// 	if err != nil {
+// 		return err
+// 	}
+
+// 	if cm == nil {
+// 		return nil
+// 	}
+// 	current := &corev1.ConfigMap{}
+// 	key := types.NamespacedName{
+// 		Namespace: cm.Namespace,
+// 		Name:      cm.Name,
+// 	}
+
+// 	return i.Client.CreateOrUpdate(ctx, key, current, cm, func() bool {
+// 		return !reflect.DeepEqual(cm.Data, current.Data)
+// 	})
+// }
+
+// createOrUpdateDeployment creates a Deployment in the kube api server based on the provided
+// ResourceRender, if it doesn't exist and updates it if it does.
+func (i *Infra) createOrUpdateDeployment(ctx context.Context, r ResourceRender) error {
+	deployment, err := r.Deployment()
+	if err != nil {
+		return err
+	}
+
+	current := &appsv1.Deployment{}
+	key := types.NamespacedName{
+		Namespace: deployment.Namespace,
+		Name:      deployment.Name,
+	}
+
+	hpa, err := r.HorizontalPodAutoscaler()
+	if err != nil {
+		return err
+	}
+
+	var opts cmp.Options
+	if hpa != nil {
+		opts = append(opts, cmpopts.IgnoreFields(appsv1.DeploymentSpec{}, "Replicas"))
+	}
+
+	return i.Client.CreateOrUpdate(ctx, key, current, deployment, func() bool {
+		return !cmp.Equal(current.Spec, deployment.Spec, opts...)
+	})
+}
+
+// createOrUpdateHPA creates HorizontalPodAutoscaler object in the kube api server based on
+// the provided ResourceRender, if it doesn't exist and updates it if it does,
+// and delete hpa if not set.
+func (i *Infra) createOrUpdateHPA(ctx context.Context, r ResourceRender) error {
+	hpa, err := r.HorizontalPodAutoscaler()
+	if err != nil {
+		return err
+	}
+
+	// when HorizontalPodAutoscaler is not set,
+	// then delete the object in the kube api server if any.
+	if hpa == nil {
+		return i.deleteHPA(ctx, r)
+	}
+	current := &autoscalingv2.HorizontalPodAutoscaler{}
+	key := types.NamespacedName{
+		Namespace: hpa.Namespace,
+		Name:      hpa.Name,
+	}
+	return i.Client.CreateOrUpdate(ctx, key, current, hpa, func() bool {
+		return !cmp.Equal(hpa.Spec, current.Spec)
+	})
+}
+
+// createOrUpdateRateLimitService creates a Service in the kube api server based on the provided ResourceRender,
+// if it doesn't exist or updates it if it does.
+func (i *Infra) createOrUpdateService(ctx context.Context, r ResourceRender) error {
+	svc, err := r.Service()
+	if err != nil {
+		return err
+	}
+
+	current := &corev1.Service{}
+	key := types.NamespacedName{
+		Namespace: svc.Namespace,
+		Name:      svc.Name,
+	}
+
+	return i.Client.CreateOrUpdate(ctx, key, current, svc, func() bool {
+		return !resource.CompareSvc(svc, current)
+	})
+}
+
+// deleteServiceAccount deletes the ServiceAccount in the kube api server, if it exists.
+func (i *Infra) deleteServiceAccount(ctx context.Context, r ResourceRender) error {
+	sa := &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: i.Namespace,
+			Name:      r.Name(),
+		},
+	}
+
+	return i.Client.Delete(ctx, sa)
+}
+
+// deleteDeployment deletes the Envoy Deployment in the kube api server, if it exists.
+func (i *Infra) deleteDeployment(ctx context.Context, r ResourceRender) error {
+	deployment := &appsv1.Deployment{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: i.Namespace,
+			Name:      r.Name(),
+		},
+	}
+
+	return i.Client.Delete(ctx, deployment)
+}
+
+// deleteConfigMap deletes the ConfigMap in the kube api server, if it exists.
+func (i *Infra) deleteConfigMap(ctx context.Context, r ResourceRender) error {
+	cm := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: i.Namespace,
+			Name:      r.Name(),
+		},
+	}
+
+	return i.Client.Delete(ctx, cm)
+}
+
+// deleteService deletes the Service in the kube api server, if it exists.
+func (i *Infra) deleteService(ctx context.Context, r ResourceRender) error {
+	svc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: i.Namespace,
+			Name:      r.Name(),
+		},
+	}
+
+	return i.Client.Delete(ctx, svc)
+}
+
+// deleteHpa deletes the Horizontal Pod Autoscaler associated to its renderer, if it exists.
+func (i *Infra) deleteHPA(ctx context.Context, r ResourceRender) error {
+	hpa := &autoscalingv2.HorizontalPodAutoscaler{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: i.Namespace,
+			Name:      r.Name(),
+		},
+	}
+
+	return i.Client.Delete(ctx, hpa)
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
new file mode 100644
index 000000000..d301e3059
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -0,0 +1,728 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package proxy
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/wso2/apk/adapter/config"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/envoy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/version"
+
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	utils "github.com/wso2/apk/adapter/pkg/utils/misc"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	SdsCAFilename   = "xds-trusted-ca.json"
+	SdsCertFilename = "xds-certificate.json"
+	// XdsTLSCertFilename is the fully qualified path of the file containing Envoy's
+	// xDS server TLS certificate.
+	XdsTLSCertFilename = "/home/wso2/security/keystore/router.crt"
+	// XdsTLSCertFilename = "/home/wso2/security/keystore/router.crt"
+	// XdsTLSKeyFilename is the fully qualified path of the file containing Envoy's
+	// xDS server TLS key.
+	XdsTLSKeyFilename = "/home/wso2/security/keystore/router.key"
+	// XdsTLSKeyFilename = "/home/wso2/security/keystore/router.key"
+	// XdsTLSCaFilename is the fully qualified path of the file containing Envoy's
+	// trusted CA certificate.
+	// XdsTLSCaFilename = "/certs/ca.crt"
+	XdsTLSCaFilename = "/home/wso2/security/truststore/adapter.crt"
+	// envoyContainerName is the name of the Envoy container.
+	envoyContainerName    = "envoy"
+	enforcerContainerName = "enforcer"
+	// envoyNsEnvVar is the name of the Envoy Gateway namespace environment variable.
+	envoyNsEnvVar = "ENVOY_GATEWAY_NAMESPACE"
+	// envoyPodEnvVar is the name of the Envoy pod name environment variable.
+	envoyPodEnvVar = "ENVOY_POD_NAME"
+)
+
+var (
+	// xDS certificate rotation is supported by using SDS path-based resource files.
+	SdsCAConfigMapData = fmt.Sprintf(`{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",`+
+		`"name":"xds_trusted_ca","validation_context":{"trusted_ca":{"filename":"%s"},`+
+		`"match_typed_subject_alt_names":[{"san_type":"DNS","matcher":{"exact":"envoy-gateway"}}]}}]}`, XdsTLSCaFilename)
+	SdsCertConfigMapData = fmt.Sprintf(`{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",`+
+		`"name":"xds_certificate","tls_certificate":{"certificate_chain":{"filename":"%s"},`+
+		`"private_key":{"filename":"%s"}}}]}`, XdsTLSCertFilename, XdsTLSKeyFilename)
+)
+
+// ExpectedResourceHashedName returns expected resource hashed name including up to the 48 characters of the original name.
+func ExpectedResourceHashedName(name string) string {
+	hashedName := utils.GetHashedName(name, 35)
+	return hashedName
+}
+
+// EnvoyAppLabel returns the labels used for all Envoy resources.
+func EnvoyAppLabel() map[string]string {
+	return map[string]string{
+		"app.kubernetes.io/name":       "envoy",
+		"app.kubernetes.io/component":  "proxy",
+		"app.kubernetes.io/managed-by": "envoy-gateway",
+	}
+}
+
+// EnvoyAppLabelSelector returns the labels used for all Envoy resources.
+func EnvoyAppLabelSelector() []string {
+	return []string{
+		"app.kubernetes.io/name=envoy",
+		"app.kubernetes.io/component=proxy",
+		"app.kubernetes.io/managed-by=envoy-gateway",
+	}
+}
+
+// envoyLabels returns the labels, including extraLabels, used for Envoy resources.
+func envoyLabels(extraLabels map[string]string) map[string]string {
+	labels := EnvoyAppLabel()
+	for k, v := range extraLabels {
+		labels[k] = v
+	}
+
+	return labels
+}
+
+func enablePrometheus(infra *ir.ProxyInfra) bool {
+	return false
+}
+
+// expectedProxyContainers returns expected proxy containers.
+func expectedProxyContainers(infra *ir.ProxyInfra,
+	deploymentConfig *egv1a1.KubernetesDeploymentSpec,
+	shutdownConfig *egv1a1.ShutdownConfig) ([]corev1.Container, error) {
+	// Define slice to hold container ports
+	var ports []corev1.ContainerPort
+
+	// Iterate over listeners and ports to get container ports
+	for _, listener := range infra.Listeners {
+		for _, p := range listener.Ports {
+			var protocol corev1.Protocol
+			switch p.Protocol {
+			case ir.HTTPProtocolType, ir.HTTPSProtocolType, ir.TLSProtocolType, ir.TCPProtocolType:
+				protocol = corev1.ProtocolTCP
+			case ir.UDPProtocolType:
+				protocol = corev1.ProtocolUDP
+			default:
+				return nil, fmt.Errorf("invalid protocol %q", p.Protocol)
+			}
+			port := corev1.ContainerPort{
+				// hashed container port name including up to the 6 characters of the port name and the maximum of 15 characters.
+				Name:          utils.GetHashedName(p.Name, 6),
+				ContainerPort: p.ContainerPort,
+				Protocol:      protocol,
+			}
+			ports = append(ports, port)
+		}
+	}
+
+	if enablePrometheus(infra) {
+		ports = append(ports, corev1.ContainerPort{
+			Name:          "metrics",
+			ContainerPort: bootstrap.EnvoyReadinessPort, // TODO: make this configurable
+			Protocol:      corev1.ProtocolTCP,
+		})
+	}
+
+	var bootstrapConfigurations string
+
+	var proxyMetrics *egv1a1.ProxyMetrics
+
+	// Get the default Bootstrap
+	bootstrapConfigurations, err := bootstrap.GetRenderedBootstrapConfig(proxyMetrics)
+	if err != nil {
+		return nil, err
+	}
+
+	args := []string{
+		fmt.Sprintf("--service-cluster %s", infra.Name),
+		fmt.Sprintf("--service-node $(%s)", envoyPodEnvVar),
+		fmt.Sprintf("--config-yaml %s", bootstrapConfigurations),
+		fmt.Sprintf("--log-level %s", "warn"),
+		"--cpuset-threads",
+	}
+
+	// if infra.Config != nil &&
+	// 	infra.Config.Spec.Concurrency != nil {
+	// 	args = append(args, fmt.Sprintf("--concurrency %d", *infra.Config.Spec.Concurrency))
+	// }
+
+	// if componentsLogLevel := logging.GetEnvoyProxyComponentLevel(); componentsLogLevel != "" {
+	// 	args = append(args, fmt.Sprintf("--component-log-level %s", componentsLogLevel))
+	// }
+
+	if shutdownConfig != nil && shutdownConfig.DrainTimeout != nil {
+		args = append(args, fmt.Sprintf("--drain-time-s %.0f", shutdownConfig.DrainTimeout.Seconds()))
+	}
+
+	// if infra.Config != nil {
+	// 	args = append(args, infra.Config.Spec.ExtraArgs...)
+	// }
+
+	containers := []corev1.Container{
+		{
+			Name:                     envoyContainerName,
+			Image:                    *deploymentConfig.EnvoyProxyContainer.Image,
+			ImagePullPolicy:          corev1.PullIfNotPresent,
+			Command:                  []string{"envoy"},
+			Args:                     args,
+			Env:                      expectedContainerEnv(deploymentConfig.EnvoyProxyContainer),
+			Resources:                *deploymentConfig.EnvoyProxyContainer.Resources,
+			SecurityContext:          deploymentConfig.EnvoyProxyContainer.SecurityContext,
+			Ports:                    ports,
+			VolumeMounts:             expectedContainerVolumeMounts(deploymentConfig.EnvoyProxyContainer),
+			TerminationMessagePolicy: corev1.TerminationMessageReadFile,
+			TerminationMessagePath:   "/dev/termination-log",
+			ReadinessProbe: &corev1.Probe{
+				ProbeHandler: corev1.ProbeHandler{
+					HTTPGet: &corev1.HTTPGetAction{
+						Path:   bootstrap.EnvoyReadinessPath,
+						Port:   intstr.IntOrString{Type: intstr.Int, IntVal: bootstrap.EnvoyReadinessPort},
+						Scheme: corev1.URISchemeHTTP,
+					},
+				},
+				TimeoutSeconds:   1,
+				PeriodSeconds:    10,
+				SuccessThreshold: 1,
+				FailureThreshold: 3,
+			},
+			Lifecycle: &corev1.Lifecycle{
+				PreStop: &corev1.LifecycleHandler{
+					HTTPGet: &corev1.HTTPGetAction{
+						Path:   envoy.ShutdownManagerReadyPath,
+						Port:   intstr.FromInt32(envoy.ShutdownManagerPort),
+						Scheme: corev1.URISchemeHTTP,
+					},
+				},
+			},
+		},
+		{
+			Name:                     "shutdown-manager",
+			Image:                    expectedShutdownManagerImage(),
+			ImagePullPolicy:          corev1.PullIfNotPresent,
+			Command:                  []string{"envoy-gateway"},
+			Args:                     expectedShutdownManagerArgs(shutdownConfig),
+			Env:                      expectedContainerEnv(nil),
+			Resources:                *egv1a1.DefaultShutdownManagerContainerResourceRequirements(),
+			TerminationMessagePolicy: corev1.TerminationMessageReadFile,
+			TerminationMessagePath:   "/dev/termination-log",
+			ReadinessProbe: &corev1.Probe{
+				ProbeHandler: corev1.ProbeHandler{
+					HTTPGet: &corev1.HTTPGetAction{
+						Path:   envoy.ShutdownManagerHealthCheckPath,
+						Port:   intstr.IntOrString{Type: intstr.Int, IntVal: envoy.ShutdownManagerPort},
+						Scheme: corev1.URISchemeHTTP,
+					},
+				},
+				TimeoutSeconds:   1,
+				PeriodSeconds:    10,
+				SuccessThreshold: 1,
+				FailureThreshold: 3,
+			},
+			LivenessProbe: &corev1.Probe{
+				ProbeHandler: corev1.ProbeHandler{
+					HTTPGet: &corev1.HTTPGetAction{
+						Path:   envoy.ShutdownManagerHealthCheckPath,
+						Port:   intstr.IntOrString{Type: intstr.Int, IntVal: envoy.ShutdownManagerPort},
+						Scheme: corev1.URISchemeHTTP,
+					},
+				},
+				TimeoutSeconds:   1,
+				PeriodSeconds:    10,
+				SuccessThreshold: 1,
+				FailureThreshold: 3,
+			},
+			Lifecycle: &corev1.Lifecycle{
+				PreStop: &corev1.LifecycleHandler{
+					Exec: &corev1.ExecAction{
+						Command: expectedShutdownPreStopCommand(shutdownConfig),
+					},
+				},
+			},
+		},
+		{
+			Name:            enforcerContainerName,
+			Image:           *deploymentConfig.EnforcerContainer.Image,
+			ImagePullPolicy: corev1.PullIfNotPresent,
+			// Command:                  []string{"envoy"},
+			// Args:                     args,
+			Env:                      expectedEnforcerEnv(deploymentConfig.EnforcerContainer),
+			Resources:                *deploymentConfig.EnforcerContainer.Resources,
+			SecurityContext:          deploymentConfig.EnforcerContainer.SecurityContext,
+			Ports:                    expectedEnforcerPorts(),
+			VolumeMounts:             expectedEnforcerVolumeMounts(deploymentConfig.EnforcerContainer),
+			TerminationMessagePolicy: corev1.TerminationMessageReadFile,
+			TerminationMessagePath:   "/dev/termination-log",
+			//todo(amali)
+			// 	ReadinessProbe: &corev1.Probe{
+			// 		ProbeHandler: corev1.ProbeHandler{
+			// 			Exec: &corev1.ExecAction{
+			// 				Command: []string{"sh", "check_health.sh"},
+			// 			},
+			// 		},
+			// 		TimeoutSeconds:      1,
+			// 		PeriodSeconds:       20,
+			// 		SuccessThreshold:    1,
+			// 		FailureThreshold:    5,
+			// 		InitialDelaySeconds: 20,
+			// 	},
+			// 	LivenessProbe: &corev1.Probe{
+			// 		ProbeHandler: corev1.ProbeHandler{
+			// 			Exec: &corev1.ExecAction{
+			// 				Command: []string{"sh", "check_health.sh"},
+			// 			},
+			// 		},
+			// 		TimeoutSeconds:      1,
+			// 		PeriodSeconds:       20,
+			// 		SuccessThreshold:    1,
+			// 		FailureThreshold:    5,
+			// 		InitialDelaySeconds: 20,
+			// 	},
+		},
+	}
+
+	return containers, nil
+}
+
+func expectedShutdownManagerImage() string {
+	if v := version.Get().ShutdownManagerVersion; v != "" {
+		return fmt.Sprintf("%s:%s", strings.Split(egv1a1.DefaultShutdownManagerImage, ":")[0], v)
+	}
+	return egv1a1.DefaultShutdownManagerImage
+}
+
+func expectedShutdownManagerArgs(cfg *egv1a1.ShutdownConfig) []string {
+	args := []string{"envoy", "shutdown-manager"}
+	if cfg != nil && cfg.DrainTimeout != nil {
+		args = append(args, fmt.Sprintf("--ready-timeout=%.0fs", cfg.DrainTimeout.Seconds()+10))
+	}
+	return args
+}
+
+func expectedShutdownPreStopCommand(cfg *egv1a1.ShutdownConfig) []string {
+	command := []string{"envoy-gateway", "envoy", "shutdown"}
+
+	if cfg == nil {
+		return command
+	}
+
+	if cfg.DrainTimeout != nil {
+		command = append(command, fmt.Sprintf("--drain-timeout=%.0fs", cfg.DrainTimeout.Seconds()))
+	}
+
+	if cfg.MinDrainDuration != nil {
+		command = append(command, fmt.Sprintf("--min-drain-duration=%.0fs", cfg.MinDrainDuration.Seconds()))
+	}
+
+	return command
+}
+
+// expectedContainerVolumeMounts returns expected proxy container volume mounts.
+func expectedContainerVolumeMounts(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.VolumeMount {
+	volumeMounts := []corev1.VolumeMount{
+		// {
+		// 	Name:      "certs",
+		// 	MountPath: "/certs",
+		// 	ReadOnly:  true,
+		// },
+		// {
+		// 	Name:      "sds",
+		// 	MountPath: "/sds",
+		// },
+		{
+			Name:      "ratelimiter-truststore-secret-volume",
+			MountPath: "/home/wso2/security/truststore/ratelimiter-ca.crt",
+			SubPath:   "ca.crt",
+		},
+		{
+			Name:      "ratelimiter-truststore-secret-volume",
+			MountPath: "/home/wso2/security/truststore/ratelimiter.crt",
+			SubPath:   "tls.crt",
+		},
+		// {
+		// 	Name:      "log-conf-volume",
+		// 	MountPath: "/home/wso2/conf/",
+		// },
+		{
+			Name:      "enforcer-keystore-secret-volume",
+			MountPath: "/home/wso2/security/truststore/enforcer.crt",
+			SubPath:   "tls.crt",
+		},
+		{
+			Name:      "adapter-truststore-secret-volume",
+			MountPath: "/home/wso2/security/truststore/adapter.crt",
+			SubPath:   "tls.crt",
+		},
+		{
+			MountPath: "/home/wso2/security/keystore/router.crt",
+			Name:      "router-keystore-secret-volume",
+			SubPath:   "tls.crt",
+		},
+		{
+			MountPath: "/home/wso2/security/keystore/router.key",
+			Name:      "router-keystore-secret-volume",
+			SubPath:   "tls.key",
+		},
+	}
+
+	return resource.ExpectedContainerVolumeMounts(containerSpec, volumeMounts)
+}
+
+func expectedEnforcerPorts() []corev1.ContainerPort {
+	ports := []corev1.ContainerPort{
+		{
+			Name:          "ext-auth",
+			ContainerPort: int32(8081),
+			Protocol:      corev1.ProtocolTCP,
+		},
+		{
+			// Name:          "ExtAuthServer",
+			ContainerPort: int32(9001),
+			Protocol:      corev1.ProtocolTCP,
+		},
+		{
+			Name:          "debug",
+			ContainerPort: int32(5006),
+			Protocol:      corev1.ProtocolTCP,
+		},
+		{
+			Name:          "jwks",
+			ContainerPort: int32(9092),
+			Protocol:      corev1.ProtocolTCP,
+		},
+		{
+			Name:          "cc-xds",
+			ContainerPort: int32(18002),
+			Protocol:      corev1.ProtocolTCP,
+		},
+	}
+
+	return ports
+}
+
+// expectedContainerVolumeMounts returns expected proxy container volume mounts.
+func expectedEnforcerVolumeMounts(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.VolumeMount {
+	volumeMounts := []corev1.VolumeMount{
+		{
+			Name:      "tmp",
+			MountPath: "/tmp",
+			ReadOnly:  true,
+		},
+		{
+			Name:      "enforcer-keystore-secret-volume",
+			MountPath: "/home/wso2/security/keystore/enforcer.key",
+			SubPath:   "tls.key",
+		},
+
+		{MountPath: "/home/wso2/security/keystore/enforcer.crt",
+			Name:    "enforcer-keystore-secret-volume",
+			SubPath: "tls.crt",
+		},
+		{MountPath: "/home/wso2/security/truststore/apk.crt",
+			Name:    "enforcer-keystore-secret-volume",
+			SubPath: "ca.crt",
+		},
+		{MountPath: "/home/wso2/security/truststore/enforcer.crt",
+			Name:    "enforcer-keystore-secret-volume",
+			SubPath: "tls.crt",
+		},
+		{MountPath: "/home/wso2/security/truststore/adapter.crt",
+			Name:    "adapter-truststore-secret-volume",
+			SubPath: "tls.crt",
+		},
+		{MountPath: "/home/wso2/security/truststore/router.crt",
+			Name:    "router-keystore-secret-volume",
+			SubPath: "tls.crt",
+		},
+		// {MountPath: "/home/wso2/conf/",
+		// 	Name: "log-conf-volume",
+		// },
+		{MountPath: "/home/wso2/security/keystore/mg.pem",
+			Name:    "enforcer-jwt-secret-volume",
+			SubPath: "mg.pem",
+		},
+		{MountPath: "/home/wso2/security/truststore/mg.pem",
+			Name:    "enforcer-jwt-secret-volume",
+			SubPath: "mg.pem",
+		},
+		{MountPath: "/home/wso2/security/keystore/mg.key",
+			Name:    "enforcer-jwt-secret-volume",
+			SubPath: "mg.key",
+		},
+		{MountPath: "/home/wso2/security/truststore/wso2carbon.pem",
+			Name:    "enforcer-trusted-certs",
+			SubPath: "wso2carbon.pem",
+		},
+		{MountPath: "/home/wso2/security/truststore/wso2-apim-carbon.pem",
+			Name:    "enforcer-apikey-cert",
+			SubPath: "wso2-apim-carbon.pem",
+		},
+		{MountPath: "/home/wso2/security/truststore/idp.pem",
+			Name:    "idp-certificate-secret-volume",
+			SubPath: "wso2carbon.pem",
+		},
+	}
+
+	return resource.ExpectedContainerVolumeMounts(containerSpec, volumeMounts)
+}
+
+// expectedDeploymentVolumes returns expected proxy deployment volumes.
+func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDeploymentSpec) []corev1.Volume {
+	volumes := []corev1.Volume{
+		// {
+		// 	Name: "certs",
+		// 	VolumeSource: corev1.VolumeSource{
+		// 		Secret: &corev1.SecretVolumeSource{
+		// 			SecretName:  "envoy",
+		// 			DefaultMode: ptr.To[int32](420),
+		// 		},
+		// 	},
+		// },
+		// {
+		// 	Name: "sds",
+		// 	VolumeSource: corev1.VolumeSource{
+		// 		ConfigMap: &corev1.ConfigMapVolumeSource{
+		// 			LocalObjectReference: corev1.LocalObjectReference{
+		// 				Name: ExpectedResourceHashedName(name),
+		// 			},
+		// 			Items: []corev1.KeyToPath{
+		// 				{
+		// 					Key:  SdsCAFilename,
+		// 					Path: SdsCAFilename,
+		// 				},
+		// 				{
+		// 					Key:  SdsCertFilename,
+		// 					Path: SdsCertFilename,
+		// 				},
+		// 			},
+		// 			DefaultMode: ptr.To[int32](420),
+		// 			Optional:    ptr.To(false),
+		// 		},
+		// 	},
+		// },
+		{
+			Name: "ratelimiter-truststore-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					SecretName:  "apk-test-wso2-apk-ratelimiter-server-cert",
+					DefaultMode: ptr.To[int32](420),
+				},
+			},
+		},
+		{
+			Name: "enforcer-keystore-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-enforcer-server-cert",
+				},
+			},
+		},
+		// {
+		// 	Name: "log-conf-volume",
+		// 	VolumeSource: corev1.VolumeSource{
+		// 		ConfigMap: &corev1.ConfigMapVolumeSource{
+		// 			DefaultMode: ptr.To[int32](420),
+		// 			LocalObjectReference: corev1.LocalObjectReference{
+		// 				Name: "apk-test-wso2-apk-log-conf",
+		// 			},
+		// 		},
+		// 	},
+		// },
+		{
+			Name: "router-keystore-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "envoy-cert",
+				},
+			},
+		},
+		{
+			Name: "adapter-truststore-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-adapter-server-cert",
+				},
+			},
+		},
+		{
+			Name: "enforcer-jwt-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-enforcer-keystore-secret",
+				},
+			},
+		},
+		{
+			Name: "enforcer-trusted-certs",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+				},
+			},
+		},
+		{
+			Name: "enforcer-apikey-cert",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+				},
+			},
+		},
+		{
+			Name: "idp-certificate-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+				},
+			},
+		},
+		{
+			Name: "tmp",
+			VolumeSource: corev1.VolumeSource{
+				EmptyDir: &corev1.EmptyDirVolumeSource{},
+			},
+		},
+	}
+
+	return resource.ExpectedDeploymentVolumes(deploymentSpec.Pod, volumes)
+}
+
+// expectedContainerEnv returns expected proxy container envs.
+func expectedContainerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.EnvVar {
+	env := []corev1.EnvVar{
+		{
+			Name: envoyNsEnvVar,
+			ValueFrom: &corev1.EnvVarSource{
+				FieldRef: &corev1.ObjectFieldSelector{
+					APIVersion: "v1",
+					FieldPath:  "metadata.namespace",
+				},
+			},
+		},
+		{
+			Name: envoyPodEnvVar,
+			ValueFrom: &corev1.EnvVarSource{
+				FieldRef: &corev1.ObjectFieldSelector{
+					APIVersion: "v1",
+					FieldPath:  "metadata.name",
+				},
+			},
+		},
+	}
+
+	if containerSpec != nil {
+		return resource.ExpectedContainerEnv(containerSpec, env)
+	}
+	return env
+
+}
+
+func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.EnvVar {
+	conf := config.ReadConfigs()
+	adapterNs := conf.Adapter.Namespace
+	gatewayNs := conf.Envoy.Namespace
+	env := []corev1.EnvVar{
+		{
+			Name:  "ADAPTER_HOST_NAME",
+			Value: fmt.Sprintf("apk-test-wso2-apk-adapter-service.%s.svc", adapterNs),
+		},
+		{
+			Name:  "ADAPTER_HOST",
+			Value: fmt.Sprintf("apk-test-wso2-apk-adapter-service.%s.svc", adapterNs),
+		},
+		{
+			Name:  "COMMON_CONTROLLER_HOST_NAME",
+			Value: fmt.Sprintf("apk-test-wso2-apk-common-controller-service.%s.svc", adapterNs),
+		},
+		{
+			Name:  "COMMON_CONTROLLER_HOST",
+			Value: fmt.Sprintf("apk-test-wso2-apk-common-controller-service.%s.svc", adapterNs),
+		},
+		{
+			Name:  "ENFORCER_PRIVATE_KEY_PATH",
+			Value: "/home/wso2/security/keystore/enforcer.key",
+		},
+		{
+			Name:  "ENFORCER_PUBLIC_CERT_PATH",
+			Value: "/home/wso2/security/keystore/enforcer.crt",
+		},
+		{
+			Name:  "ENFORCER_SERVER_NAME",
+			Value: fmt.Sprintf("apk-test-wso2-apk-enforcer-service.%s.svc", gatewayNs),
+		},
+		{
+			Name:  "TRUSTED_CA_CERTS_PATH",
+			Value: "/home/wso2/security/truststore",
+		},
+		{
+			Name:  "ADAPTER_XDS_PORT",
+			Value: "18000",
+		},
+		{
+			Name:  "COMMON_CONTROLLER_XDS_PORT",
+			Value: "18002",
+		},
+		{
+			Name:  "COMMON_CONTROLLER_REST_PORT",
+			Value: "18003",
+		},
+		{
+			Name:  "ENFORCER_LABEL",
+			Value: "wso2-apk-default",
+		},
+		{
+			Name:  "ENFORCER_REGION",
+			Value: "UNKNOWN",
+		},
+		{
+			Name:  "XDS_MAX_MSG_SIZE",
+			Value: "4194304",
+		},
+		{
+			Name:  "XDS_MAX_RETRIES",
+			Value: "3",
+		},
+		{
+			Name:  "JAVA_OPTS",
+			Value: "-Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2",
+		},
+	}
+
+	if containerSpec != nil {
+		return resource.ExpectedContainerEnv(containerSpec, env)
+	}
+	return env
+
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
new file mode 100644
index 000000000..3947f7b5a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
@@ -0,0 +1,351 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package proxy
+
+import (
+	"fmt"
+	"strconv"
+
+	"golang.org/x/exp/maps"
+	appsv1 "k8s.io/api/apps/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
+
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+)
+
+type ResourceRender struct {
+	infra *ir.ProxyInfra
+
+	// Namespace is the Namespace used for managed infra.
+	Namespace string
+}
+
+func NewResourceRender(ns string, infra *ir.ProxyInfra) *ResourceRender {
+	return &ResourceRender{
+		Namespace: ns,
+		infra:     infra,
+	}
+}
+
+func (r *ResourceRender) Name() string {
+	return ExpectedResourceHashedName(r.infra.Name)
+}
+
+// ServiceAccount returns the expected proxy serviceAccount.
+func (r *ResourceRender) ServiceAccount() (*corev1.ServiceAccount, error) {
+	// Set the labels based on the owning gateway name.
+	labels := envoyLabels(r.infra.GetProxyMetadata().Labels)
+	if OwningGatewayLabelsAbsent(labels) {
+		return nil, fmt.Errorf("missing owning gateway labels")
+	}
+
+	return &corev1.ServiceAccount{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ServiceAccount",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:   r.Namespace,
+			Name:        r.Name(),
+			Labels:      labels,
+			Annotations: r.infra.GetProxyMetadata().Annotations,
+		},
+	}, nil
+}
+
+// Service returns the expected Service based on the provided infra.
+func (r *ResourceRender) Service() (*corev1.Service, error) {
+	var ports []corev1.ServicePort
+	for _, listener := range r.infra.Listeners {
+		for _, port := range listener.Ports {
+			target := intstr.IntOrString{IntVal: port.ContainerPort}
+			protocol := corev1.ProtocolTCP
+			if port.Protocol == ir.UDPProtocolType {
+				protocol = corev1.ProtocolUDP
+			}
+
+			p := corev1.ServicePort{
+				Name:       ExpectedResourceHashedName(port.Name),
+				Protocol:   protocol,
+				Port:       port.ServicePort,
+				TargetPort: target,
+			}
+			ports = append(ports, p)
+
+			if port.Protocol == ir.HTTPSProtocolType {
+				if listener.HTTP3 != nil {
+					p := corev1.ServicePort{
+						Name:       ExpectedResourceHashedName(port.Name + "-h3"),
+						Protocol:   corev1.ProtocolUDP,
+						Port:       port.ServicePort,
+						TargetPort: target,
+					}
+					ports = append(ports, p)
+				}
+			}
+		}
+	}
+
+	// Set the labels based on the owning gatewayclass name.
+	labels := envoyLabels(r.infra.GetProxyMetadata().Labels)
+	if OwningGatewayLabelsAbsent(labels) {
+		return nil, fmt.Errorf("missing owning gateway labels")
+	}
+
+	// Get annotations
+	annotations := map[string]string{}
+	maps.Copy(annotations, r.infra.GetProxyMetadata().Annotations)
+
+	provider := r.infra.GetProxyConfig().GetEnvoyProxyProvider()
+	envoyServiceConfig := provider.GetEnvoyProxyKubeProvider().EnvoyService
+	if envoyServiceConfig.Annotations != nil {
+		maps.Copy(annotations, envoyServiceConfig.Annotations)
+	}
+	if len(annotations) == 0 {
+		annotations = nil
+	}
+
+	// Set the spec of gateway service
+	serviceSpec := resource.ExpectedServiceSpec(envoyServiceConfig)
+	serviceSpec.Ports = ports
+	serviceSpec.Selector = resource.GetSelector(labels).MatchLabels
+
+	if (*envoyServiceConfig.Type) == egv1a1.ServiceTypeClusterIP {
+		if len(r.infra.Addresses) > 0 {
+			// Since K8s Service requires specify no more than one IP for each IP family
+			// So we only use the first address
+			// if address is not set, the automatically assigned clusterIP is used
+			serviceSpec.ClusterIP = r.infra.Addresses[0]
+			serviceSpec.ClusterIPs = r.infra.Addresses[0:1]
+		}
+	} else {
+		serviceSpec.ExternalIPs = r.infra.Addresses
+	}
+
+	svc := &corev1.Service{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "Service",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:   r.Namespace,
+			Name:        r.Name(),
+			Labels:      labels,
+			Annotations: annotations,
+		},
+		Spec: serviceSpec,
+	}
+
+	// apply merge patch to service
+	var err error
+	if svc, err = envoyServiceConfig.ApplyMergePatch(svc); err != nil {
+		return nil, err
+	}
+
+	return svc, nil
+}
+
+// ConfigMap returns the expected ConfigMap based on the provided infra.
+func (r *ResourceRender) ConfigMap() (*corev1.ConfigMap, error) {
+	// Set the labels based on the owning gateway name.
+	labels := envoyLabels(r.infra.GetProxyMetadata().Labels)
+	if OwningGatewayLabelsAbsent(labels) {
+		return nil, fmt.Errorf("missing owning gateway labels")
+	}
+
+	return &corev1.ConfigMap{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ConfigMap",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:   r.Namespace,
+			Name:        r.Name(),
+			Labels:      labels,
+			Annotations: r.infra.GetProxyMetadata().Annotations,
+		},
+		Data: map[string]string{
+			SdsCAFilename:   SdsCAConfigMapData,
+			SdsCertFilename: SdsCertConfigMapData,
+		},
+	}, nil
+}
+
+// Deployment returns the expected Deployment based on the provided infra.
+func (r *ResourceRender) Deployment() (*appsv1.Deployment, error) {
+	proxyConfig := r.infra.GetProxyConfig()
+
+	// Get the EnvoyProxy config to configure the deployment.
+	provider := proxyConfig.GetEnvoyProxyProvider()
+	if provider.Type != egv1a1.ProviderTypeKubernetes {
+		return nil, fmt.Errorf("invalid provider type %v for Kubernetes infra manager", provider.Type)
+	}
+	deploymentConfig := provider.GetEnvoyProxyKubeProvider().EnvoyDeployment
+
+	// Get expected bootstrap configurations rendered ProxyContainers
+	containers, err := expectedProxyContainers(r.infra, deploymentConfig, proxyConfig.Spec.Shutdown)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set the labels based on the owning gateway name.
+	dpAnnotations := r.infra.GetProxyMetadata().Annotations
+	labels := r.infra.GetProxyMetadata().Labels
+	dpLabels := envoyLabels(labels)
+	if OwningGatewayLabelsAbsent(dpLabels) {
+		return nil, fmt.Errorf("missing owning gateway labels")
+	}
+
+	maps.Copy(labels, deploymentConfig.Pod.Labels)
+	podLabels := envoyLabels(labels)
+	selector := resource.GetSelector(podLabels)
+
+	// Get annotations
+	podAnnotations := map[string]string{}
+	maps.Copy(podAnnotations, dpAnnotations)
+	maps.Copy(podAnnotations, deploymentConfig.Pod.Annotations)
+	if enablePrometheus(r.infra) {
+		podAnnotations["prometheus.io/path"] = "/stats/prometheus" // TODO: make this configurable
+		podAnnotations["prometheus.io/scrape"] = "true"
+		podAnnotations["prometheus.io/port"] = strconv.Itoa(bootstrap.EnvoyReadinessPort)
+	}
+	if len(podAnnotations) == 0 {
+		podAnnotations = nil
+	}
+
+	deployment := &appsv1.Deployment{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Deployment",
+			APIVersion: "apps/v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:   r.Namespace,
+			Name:        r.Name(),
+			Labels:      dpLabels,
+			Annotations: dpAnnotations,
+		},
+		Spec: appsv1.DeploymentSpec{
+			Replicas: deploymentConfig.Replicas,
+			Strategy: *deploymentConfig.Strategy,
+			Selector: selector,
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels:      selector.MatchLabels,
+					Annotations: podAnnotations,
+				},
+				Spec: corev1.PodSpec{
+					Containers:                    containers,
+					InitContainers:                deploymentConfig.InitContainers,
+					ServiceAccountName:            ExpectedResourceHashedName(r.infra.Name),
+					AutomountServiceAccountToken:  ptr.To(false),
+					TerminationGracePeriodSeconds: expectedTerminationGracePeriodSeconds(proxyConfig.Spec.Shutdown),
+					DNSPolicy:                     corev1.DNSClusterFirst,
+					RestartPolicy:                 corev1.RestartPolicyAlways,
+					SchedulerName:                 "default-scheduler",
+					SecurityContext:               deploymentConfig.Pod.SecurityContext,
+					Affinity:                      deploymentConfig.Pod.Affinity,
+					Tolerations:                   deploymentConfig.Pod.Tolerations,
+					Volumes:                       expectedDeploymentVolumes(r.infra.Name, deploymentConfig),
+					ImagePullSecrets:              deploymentConfig.Pod.ImagePullSecrets,
+					NodeSelector:                  deploymentConfig.Pod.NodeSelector,
+					TopologySpreadConstraints:     deploymentConfig.Pod.TopologySpreadConstraints,
+				},
+			},
+			RevisionHistoryLimit:    ptr.To[int32](10),
+			ProgressDeadlineSeconds: ptr.To[int32](600),
+		},
+	}
+
+	// omit the deployment replicas if HPA is being set
+	if provider.GetEnvoyProxyKubeProvider().EnvoyHpa != nil {
+		deployment.Spec.Replicas = nil
+	}
+
+	// apply merge patch to deployment
+	if deployment, err = deploymentConfig.ApplyMergePatch(deployment); err != nil {
+		return nil, err
+	}
+
+	return deployment, nil
+}
+
+func expectedTerminationGracePeriodSeconds(cfg *egv1a1.ShutdownConfig) *int64 {
+	s := 900 // default
+	if cfg != nil && cfg.DrainTimeout != nil {
+		s = int(cfg.DrainTimeout.Seconds() + 300) // 5 minutes longer than drain timeout
+	}
+	return ptr.To(int64(s))
+}
+
+func (r *ResourceRender) HorizontalPodAutoscaler() (*autoscalingv2.HorizontalPodAutoscaler, error) {
+	provider := r.infra.GetProxyConfig().GetEnvoyProxyProvider()
+	if provider.Type != egv1a1.ProviderTypeKubernetes {
+		return nil, fmt.Errorf("invalid provider type %v for Kubernetes infra manager", provider.Type)
+	}
+
+	hpaConfig := provider.GetEnvoyProxyKubeProvider().EnvoyHpa
+	if hpaConfig == nil {
+		return nil, nil
+	}
+
+	hpa := &autoscalingv2.HorizontalPodAutoscaler{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "autoscaling/v2",
+			Kind:       "HorizontalPodAutoscaler",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:   r.Namespace,
+			Name:        r.Name(),
+			Annotations: r.infra.GetProxyMetadata().Annotations,
+			Labels:      r.infra.GetProxyMetadata().Labels,
+		},
+		Spec: autoscalingv2.HorizontalPodAutoscalerSpec{
+			ScaleTargetRef: autoscalingv2.CrossVersionObjectReference{
+				APIVersion: "apps/v1",
+				Kind:       "Deployment",
+				Name:       r.Name(),
+			},
+			MinReplicas: hpaConfig.MinReplicas,
+			MaxReplicas: ptr.Deref(hpaConfig.MaxReplicas, 1),
+			Metrics:     hpaConfig.Metrics,
+			Behavior:    hpaConfig.Behavior,
+		},
+	}
+
+	return hpa, nil
+}
+
+// OwningGatewayLabelsAbsent Check if labels are missing some OwningGatewayLabels
+func OwningGatewayLabelsAbsent(labels map[string]string) bool {
+	return (len(labels[gatewayapi.OwningGatewayNameLabel]) == 0 ||
+		len(labels[gatewayapi.OwningGatewayNamespaceLabel]) == 0) &&
+		len(labels[gatewayapi.OwningGatewayClassLabel]) == 0
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider_test.go
new file mode 100644
index 000000000..7281ec61e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider_test.go
@@ -0,0 +1,989 @@
+// // Copyright Envoy Gateway Authors
+// // SPDX-License-Identifier: Apache-2.0
+// // The full text of the Apache license is available in the LICENSE file at
+// // the root of the repo.
+
+package proxy
+
+// import (
+// 	"flag"
+// 	"fmt"
+// 	"os"
+// 	"sort"
+// 	"testing"
+// 	"time"
+
+// 	"github.com/stretchr/testify/assert"
+// 	"github.com/stretchr/testify/require"
+// 	appsv1 "k8s.io/api/apps/v1"
+// 	autoscalingv2 "k8s.io/api/autoscaling/v2"
+// 	corev1 "k8s.io/api/core/v1"
+// 	v1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+// 	"k8s.io/apimachinery/pkg/api/resource"
+// 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+// 	"k8s.io/utils/ptr"
+// 	"sigs.k8s.io/yaml"
+
+// 	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+// 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+// 	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+// )
+
+// var (
+// 	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
+// 	defaultNamespace = "apk"
+// )
+
+// const (
+// 	// envoyHTTPPort is the container port number of Envoy's HTTP endpoint.
+// 	envoyHTTPPort = int32(8080)
+// 	// envoyHTTPSPort is the container port number of Envoy's HTTPS endpoint.
+// 	envoyHTTPSPort = int32(8443)
+// )
+
+// func newTestInfra() *ir.Infra {
+// 	return newTestInfraWithAnnotations(nil)
+// }
+
+// func newTestInfraWithAnnotations(annotations map[string]string) *ir.Infra {
+// 	return newTestInfraWithAnnotationsAndLabels(annotations, nil)
+// }
+
+// func newTestInfraWithAddresses(addresses []string) *ir.Infra {
+// 	infra := newTestInfraWithAnnotationsAndLabels(nil, nil)
+// 	infra.Proxy.Addresses = addresses
+
+// 	return infra
+// }
+
+// func newTestInfraWithAnnotationsAndLabels(annotations, labels map[string]string) *ir.Infra {
+// 	i := ir.NewInfra()
+
+// 	i.Proxy.GetProxyMetadata().Annotations = annotations
+// 	if len(labels) > 0 {
+// 		i.Proxy.GetProxyMetadata().Labels = labels
+// 	}
+// 	i.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+// 	i.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = i.Proxy.Name
+// 	i.Proxy.Listeners = []*ir.ProxyListener{
+// 		{
+// 			Ports: []ir.ListenerPort{
+// 				{
+// 					Name:          "EnvoyHTTPPort",
+// 					Protocol:      ir.TCPProtocolType,
+// 					ContainerPort: envoyHTTPPort,
+// 				},
+// 				{
+// 					Name:          "EnvoyHTTPSPort",
+// 					Protocol:      ir.TCPProtocolType,
+// 					ContainerPort: envoyHTTPSPort,
+// 				},
+// 			},
+// 		},
+// 	}
+
+// 	return i
+// }
+
+// func TestDeployment(t *testing.T) {
+
+// 	cases := []struct {
+// 		caseName     string
+// 		infra        *ir.Infra
+// 		deploy       *egv1a1.KubernetesDeploymentSpec
+// 		shutdown     *egv1a1.ShutdownConfig
+// 		proxyLogging map[egv1a1.ProxyLogComponent]egv1a1.LogLevel
+// 		bootstrap    string
+// 		telemetry    *egv1a1.ProxyTelemetry
+// 		concurrency  *int32
+// 		extraArgs    []string
+// 	}{
+// 		{
+// 			caseName: "default",
+// 			infra:    newTestInfra(),
+// 			deploy:   nil,
+// 		},
+// 		{
+// 			caseName: "custom",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Replicas: ptr.To[int32](2),
+// 				Strategy: egv1a1.DefaultKubernetesDeploymentStrategy(),
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					Labels: map[string]string{
+// 						"foo.bar": "custom-label",
+// 					},
+// 					SecurityContext: &corev1.PodSecurityContext{
+// 						RunAsUser: ptr.To[int64](1000),
+// 					},
+// 				},
+// 				EnvoyProxyContainer: &egv1a1.KubernetesContainerSpec{
+// 					Image: ptr.To("envoyproxy/envoy:v1.2.3"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 				EnforcerContainer: &egv1a1.KubernetesContainerSpec{
+// 					Image: ptr.To("wso2/apk-enforcer:1.1.0"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "patch-deployment",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Patch: &egv1a1.KubernetesPatchSpec{
+// 					Type: ptr.To(egv1a1.StrategicMerge),
+// 					Value: v1.JSON{
+// 						Raw: []byte("{\"spec\":{\"template\":{\"spec\":{\"hostNetwork\":true,\"dnsPolicy\":\"ClusterFirstWithHostNet\"}}}}"),
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "shutdown-manager",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Patch: &egv1a1.KubernetesPatchSpec{
+// 					Type: ptr.To(egv1a1.StrategicMerge),
+// 					Value: v1.JSON{
+// 						Raw: []byte(`{
+// 							"spec":{
+// 								"template":{
+// 									"spec":{
+// 										"containers":[{
+// 											"name":"shutdown-manager",
+// 											"resources":{
+// 												"requests":{"cpu":"100m","memory":"64Mi"},
+// 												"limits":{"cpu":"200m","memory":"96Mi"}
+// 											},
+// 											"securityContext":{"runAsUser":1234},
+// 											"env":[
+// 												{"name":"env_a","value":"env_a_value"},
+// 												{"name":"env_b","value":"env_b_value"}
+// 											],
+// 											"image":"envoyproxy/gateway-dev:v1.2.3"
+// 										}]
+// 									}
+// 								}
+// 							}
+// 						}`),
+// 					},
+// 				},
+// 			},
+// 			shutdown: &egv1a1.ShutdownConfig{
+// 				DrainTimeout: &metav1.Duration{
+// 					Duration: 30 * time.Second,
+// 				},
+// 				MinDrainDuration: &metav1.Duration{
+// 					Duration: 15 * time.Second,
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "bootstrap",
+// 			infra:    newTestInfra(),
+// 			deploy:   nil,
+// 			// bootstrap: `test bootstrap config`,
+// 		},
+// 		{
+// 			caseName: "extension-env",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Replicas: ptr.To[int32](2),
+// 				Strategy: egv1a1.DefaultKubernetesDeploymentStrategy(),
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					// Annotations: map[string]string{
+// 					// 	"prometheus.io/scrape": "true",
+// 					// },
+// 					SecurityContext: &corev1.PodSecurityContext{
+// 						RunAsUser: ptr.To[int64](1000),
+// 					},
+// 				},
+// 				EnvoyProxyContainer: &egv1a1.KubernetesContainerSpec{
+// 					Env: []corev1.EnvVar{
+// 						{
+// 							Name:  "env_a",
+// 							Value: "env_a_value",
+// 						},
+// 						{
+// 							Name:  "env_b",
+// 							Value: "env_b_value",
+// 						},
+// 					},
+// 					Image: ptr.To("envoyproxy/envoy:v1.2.3"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 				EnforcerContainer: &egv1a1.KubernetesContainerSpec{
+// 					// Env: []corev1.EnvVar{
+// 					// 	{
+// 					// 		Name:  "env_a",
+// 					// 		Value: "env_a_value",
+// 					// 	},
+// 					// 	{
+// 					// 		Name:  "env_b",
+// 					// 		Value: "env_b_value",
+// 					// 	},
+// 					// },
+// 					Image: ptr.To("wso2/apk-enforcer:1.1.0-ubuntu"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "default-env",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Replicas: ptr.To[int32](2),
+// 				Strategy: egv1a1.DefaultKubernetesDeploymentStrategy(),
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					// Annotations: map[string]string{
+// 					// 	"prometheus.io/scrape": "true",
+// 					// },
+// 					SecurityContext: &corev1.PodSecurityContext{
+// 						RunAsUser: ptr.To[int64](1000),
+// 					},
+// 				},
+// 				EnvoyProxyContainer: &egv1a1.KubernetesContainerSpec{
+// 					Env:   nil,
+// 					Image: ptr.To("envoyproxy/envoy:v1.2.3"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 				EnforcerContainer: &egv1a1.KubernetesContainerSpec{
+// 					Env:   nil,
+// 					Image: ptr.To("wso2/enforcer:1.1.0"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 						RunAsUser:  ptr.To[int64](1000),
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "volumes",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Replicas: ptr.To[int32](2),
+// 				Strategy: egv1a1.DefaultKubernetesDeploymentStrategy(),
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					// Annotations: map[string]string{
+// 					// 	"prometheus.io/scrape": "true",
+// 					// },
+// 					SecurityContext: &corev1.PodSecurityContext{
+// 						RunAsUser: ptr.To[int64](1000),
+// 					},
+// 					Volumes: []corev1.Volume{
+// 						{
+// 							Name: "certs",
+// 							VolumeSource: corev1.VolumeSource{
+// 								Secret: &corev1.SecretVolumeSource{
+// 									SecretName:  "custom-envoy-cert",
+// 									DefaultMode: ptr.To[int32](420),
+// 								},
+// 							},
+// 						},
+// 					},
+// 				},
+// 				EnvoyProxyContainer: &egv1a1.KubernetesContainerSpec{
+// 					Env: []corev1.EnvVar{
+// 						{
+// 							Name:  "env_a",
+// 							Value: "env_a_value",
+// 						},
+// 						{
+// 							Name:  "env_b",
+// 							Value: "env_b_value",
+// 						},
+// 					},
+// 					Image: ptr.To("envoyproxy/envoy:v1.2.3"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 				EnforcerContainer: &egv1a1.KubernetesContainerSpec{
+// 					Env: []corev1.EnvVar{
+// 						{
+// 							Name:  "env_a",
+// 							Value: "env_a_value",
+// 						},
+// 						{
+// 							Name:  "env_b",
+// 							Value: "env_b_value",
+// 						},
+// 					},
+// 					Image: ptr.To("wso2/enforcer:1.1.0"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "component-level",
+// 			infra:    newTestInfra(),
+// 			deploy:   nil,
+// 			proxyLogging: map[egv1a1.ProxyLogComponent]egv1a1.LogLevel{
+// 				egv1a1.LogComponentDefault: egv1a1.LogLevelError,
+// 				egv1a1.LogComponentFilter:  egv1a1.LogLevelInfo,
+// 			},
+// 			// bootstrap: `test bootstrap config`,
+// 		},
+// 		// {
+// 		// 	caseName: "disable-prometheus",
+// 		// 	infra:    newTestInfra(),
+// 		// 	telemetry: &egv1a1.ProxyTelemetry{
+// 		// 		Metrics: &egv1a1.ProxyMetrics{
+// 		// 			Prometheus: &egv1a1.ProxyPrometheusProvider{
+// 		// 				Disable: true,
+// 		// 			},
+// 		// 		},
+// 		// 	},
+// 		// },
+// 		{
+// 			caseName:    "with-concurrency",
+// 			infra:       newTestInfra(),
+// 			deploy:      nil,
+// 			concurrency: ptr.To[int32](4),
+// 			// bootstrap:   `test bootstrap config`,
+// 		},
+// 		{
+// 			caseName: "custom_with_initcontainers",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Replicas: ptr.To[int32](3),
+// 				Strategy: egv1a1.DefaultKubernetesDeploymentStrategy(),
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					// Annotations: map[string]string{
+// 					// 	"prometheus.io/scrape": "true",
+// 					// },
+// 					Labels: map[string]string{
+// 						"foo.bar": "custom-label",
+// 					},
+// 					SecurityContext: &corev1.PodSecurityContext{
+// 						RunAsUser: ptr.To[int64](1000),
+// 					},
+// 					Volumes: []corev1.Volume{
+// 						{
+// 							Name: "custom-libs",
+// 							VolumeSource: corev1.VolumeSource{
+// 								EmptyDir: &corev1.EmptyDirVolumeSource{},
+// 							},
+// 						},
+// 					},
+// 				},
+// 				EnvoyProxyContainer: &egv1a1.KubernetesContainerSpec{
+// 					Image: ptr.To("envoyproxy/envoy:v1.2.3"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 					VolumeMounts: []corev1.VolumeMount{
+// 						{
+// 							Name:      "custom-libs",
+// 							MountPath: "/lib/filter_foo.so",
+// 						},
+// 					},
+// 				},
+// 				EnforcerContainer: &egv1a1.KubernetesContainerSpec{
+// 					Image: ptr.To("wso2/apk-enforcer:1.1.0"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 					// VolumeMounts: []corev1.VolumeMount{
+// 					// 	{
+// 					// 		Name:      "custom-libs",
+// 					// 		MountPath: "/lib/filter_foo.so",
+// 					// 	},
+// 					// },
+// 				},
+// 				InitContainers: []corev1.Container{
+// 					{
+// 						Name:    "install-filter-foo",
+// 						Image:   "alpine:3.11.3",
+// 						Command: []string{"/bin/sh", "-c"},
+// 						Args:    []string{"echo \"Installing filter-foo\"; wget -q https://example.com/download/filter_foo_v1.0.0.tgz -O - | tar -xz --directory=/lib filter_foo.so; echo \"Done\";"},
+// 						VolumeMounts: []corev1.VolumeMount{
+// 							{
+// 								Name:      "custom-libs",
+// 								MountPath: "/lib",
+// 							},
+// 						},
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "with-annotations",
+// 			infra: newTestInfraWithAnnotations(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}),
+// 			deploy: nil,
+// 		},
+// 		{
+// 			caseName: "override-labels-and-annotations",
+// 			infra: newTestInfraWithAnnotationsAndLabels(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}, map[string]string{
+// 				"label1": "value1",
+// 				"label2": "value2",
+// 			}),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					Annotations: map[string]string{
+// 						"anno1": "value1-override",
+// 					},
+// 					Labels: map[string]string{
+// 						"label1": "value1-override",
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "with-image-pull-secrets",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					ImagePullSecrets: []corev1.LocalObjectReference{
+// 						{
+// 							Name: "aaa",
+// 						},
+// 						{
+// 							Name: "bbb",
+// 						},
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "with-node-selector",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					NodeSelector: map[string]string{
+// 						"key1": "value1",
+// 						"key2": "value2",
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "with-topology-spread-constraints",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					TopologySpreadConstraints: []corev1.TopologySpreadConstraint{
+// 						{
+// 							MaxSkew:           1,
+// 							TopologyKey:       "kubernetes.io/hostname",
+// 							WhenUnsatisfiable: corev1.DoNotSchedule,
+// 							LabelSelector: &metav1.LabelSelector{
+// 								MatchLabels: map[string]string{"app": "foo"},
+// 							},
+// 							MatchLabelKeys: []string{"pod-template-hash"},
+// 						},
+// 					},
+// 				},
+// 			},
+// 		},
+// 		// {
+// 		// 	caseName: "with-extra-args",
+// 		// 	infra:    newTestInfra(),
+// 		// 	// extraArgs: []string{"--key1 val1", "--key2 val2"},
+// 		// },
+// 	}
+// 	for _, tc := range cases {
+// 		t.Run(tc.caseName, func(t *testing.T) {
+// 			kube := tc.infra.GetProxyInfra().GetProxyConfig().GetEnvoyProxyProvider().GetEnvoyProxyKubeProvider()
+// 			if tc.deploy != nil {
+// 				kube.EnvoyDeployment = tc.deploy
+// 			}
+
+// 			replace := egv1a1.BootstrapTypeReplace
+// 			if tc.bootstrap != "" {
+// 				tc.infra.Proxy.Config.Spec.Bootstrap = &egv1a1.ProxyBootstrap{
+// 					Type:  &replace,
+// 					Value: tc.bootstrap,
+// 				}
+// 			}
+
+// 			if tc.telemetry != nil {
+// 				tc.infra.Proxy.Config.Spec.Telemetry = tc.telemetry
+// 			}
+
+// 			if len(tc.proxyLogging) > 0 {
+// 				tc.infra.Proxy.Config.Spec.Logging = egv1a1.ProxyLogging{
+// 					Level: tc.proxyLogging,
+// 				}
+// 			}
+
+// 			if tc.concurrency != nil {
+// 				tc.infra.Proxy.Config.Spec.Concurrency = tc.concurrency
+// 			}
+
+// 			if tc.shutdown != nil {
+// 				tc.infra.Proxy.Config.Spec.Shutdown = tc.shutdown
+// 			}
+
+// 			if len(tc.extraArgs) > 0 {
+// 				tc.infra.Proxy.Config.Spec.ExtraArgs = tc.extraArgs
+// 			}
+
+// 			r := NewResourceRender(defaultNamespace, tc.infra.GetProxyInfra())
+// 			dp, err := r.Deployment()
+// 			require.NoError(t, err)
+
+// 			expected, err := loadDeployment(tc.caseName)
+// 			require.NoError(t, err)
+
+// 			sortEnv := func(env []corev1.EnvVar) {
+// 				sort.Slice(env, func(i, j int) bool {
+// 					return env[i].Name > env[j].Name
+// 				})
+// 			}
+
+// 			if *overrideTestData {
+// 				deploymentYAML, err := yaml.Marshal(dp)
+// 				require.NoError(t, err)
+// 				// nolint: gosec
+// 				err = os.WriteFile(fmt.Sprintf("testdata/deployments/%s.yaml", tc.caseName), deploymentYAML, 0644)
+// 				require.NoError(t, err)
+// 				return
+// 			}
+
+// 			sortEnv(dp.Spec.Template.Spec.Containers[0].Env)
+// 			sortEnv(expected.Spec.Template.Spec.Containers[0].Env)
+// 			assert.Equal(t, expected, dp, "failed "+tc.caseName)
+// 		})
+// 	}
+// }
+
+// func loadDeployment(caseName string) (*appsv1.Deployment, error) {
+// 	deploymentYAML, err := os.ReadFile(fmt.Sprintf("testdata/deployments/%s.yaml", caseName))
+// 	if err != nil {
+// 		return nil, err
+// 	}
+// 	deployment := &appsv1.Deployment{}
+// 	_ = yaml.Unmarshal(deploymentYAML, deployment)
+// 	return deployment, nil
+// }
+
+// func TestService(t *testing.T) {
+
+// 	svcType := egv1a1.ServiceTypeClusterIP
+// 	cases := []struct {
+// 		caseName string
+// 		infra    *ir.Infra
+// 		service  *egv1a1.KubernetesServiceSpec
+// 	}{
+// 		{
+// 			caseName: "default",
+// 			infra:    newTestInfra(),
+// 			service:  nil,
+// 		},
+// 		{
+// 			caseName: "custom",
+// 			infra:    newTestInfra(),
+// 			service: &egv1a1.KubernetesServiceSpec{
+// 				Annotations: map[string]string{
+// 					"key1": "value1",
+// 				},
+// 				Type: &svcType,
+// 			},
+// 		},
+// 		{
+// 			caseName: "with-annotations",
+// 			infra: newTestInfraWithAnnotations(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}),
+// 		},
+// 		{
+// 			caseName: "override-annotations",
+// 			infra: newTestInfraWithAnnotationsAndLabels(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}, map[string]string{
+// 				"label1": "value1",
+// 				"label2": "value2",
+// 			}),
+// 			service: &egv1a1.KubernetesServiceSpec{
+// 				Annotations: map[string]string{
+// 					"anno1": "value1-override",
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "clusterIP-custom-addresses",
+// 			infra: newTestInfraWithAddresses([]string{
+// 				"10.102.168.100",
+// 			}),
+// 			service: &egv1a1.KubernetesServiceSpec{
+// 				Type: &svcType,
+// 			},
+// 		},
+// 		{
+// 			caseName: "patch-service",
+// 			infra:    newTestInfra(),
+// 			service: &egv1a1.KubernetesServiceSpec{
+// 				Patch: &egv1a1.KubernetesPatchSpec{
+// 					Type: ptr.To(egv1a1.StrategicMerge),
+// 					Value: v1.JSON{
+// 						Raw: []byte("{\"metadata\":{\"name\":\"foo\"}}"),
+// 					},
+// 				},
+// 			},
+// 		},
+// 	}
+// 	for _, tc := range cases {
+// 		t.Run(tc.caseName, func(t *testing.T) {
+// 			provider := tc.infra.GetProxyInfra().GetProxyConfig().GetEnvoyProxyProvider().GetEnvoyProxyKubeProvider()
+// 			if tc.service != nil {
+// 				provider.EnvoyService = tc.service
+// 			}
+
+// 			r := NewResourceRender(defaultNamespace, tc.infra.GetProxyInfra())
+// 			svc, err := r.Service()
+// 			require.NoError(t, err)
+
+// 			expected, err := loadService(tc.caseName)
+// 			require.NoError(t, err)
+
+// 			assert.Equal(t, expected, svc)
+// 		})
+// 	}
+// }
+
+// func loadService(caseName string) (*corev1.Service, error) {
+// 	serviceYAML, err := os.ReadFile(fmt.Sprintf("testdata/services/%s.yaml", caseName))
+// 	if err != nil {
+// 		return nil, err
+// 	}
+// 	svc := &corev1.Service{}
+// 	_ = yaml.Unmarshal(serviceYAML, svc)
+// 	return svc, nil
+// }
+
+// func TestConfigMap(t *testing.T) {
+
+// 	cases := []struct {
+// 		name  string
+// 		infra *ir.Infra
+// 	}{
+// 		{
+// 			name:  "default",
+// 			infra: newTestInfra(),
+// 		}, {
+// 			name: "with-annotations",
+// 			infra: newTestInfraWithAnnotations(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}),
+// 		},
+// 	}
+
+// 	for _, tc := range cases {
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			r := NewResourceRender(defaultNamespace, tc.infra.GetProxyInfra())
+// 			cm, err := r.ConfigMap()
+// 			require.NoError(t, err)
+
+// 			expected, err := loadConfigmap(tc.name)
+// 			require.NoError(t, err)
+
+// 			assert.Equal(t, expected, cm)
+// 		})
+// 	}
+// }
+
+// func loadConfigmap(tc string) (*corev1.ConfigMap, error) {
+// 	cmYAML, err := os.ReadFile(fmt.Sprintf("testdata/configmap/%s.yaml", tc))
+// 	if err != nil {
+// 		return nil, err
+// 	}
+// 	cm := &corev1.ConfigMap{}
+// 	_ = yaml.Unmarshal(cmYAML, cm)
+// 	return cm, nil
+// }
+
+// func TestServiceAccount(t *testing.T) {
+// 	cases := []struct {
+// 		name  string
+// 		infra *ir.Infra
+// 	}{
+// 		{
+// 			name:  "default",
+// 			infra: newTestInfra(),
+// 		}, {
+// 			name: "with-annotations",
+// 			infra: newTestInfraWithAnnotations(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}),
+// 		},
+// 	}
+
+// 	for _, tc := range cases {
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			r := NewResourceRender(defaultNamespace, tc.infra.GetProxyInfra())
+// 			sa, err := r.ServiceAccount()
+// 			require.NoError(t, err)
+
+// 			expected, err := loadServiceAccount(tc.name)
+// 			require.NoError(t, err)
+
+// 			assert.Equal(t, expected, sa)
+// 		})
+// 	}
+// }
+
+// func loadServiceAccount(tc string) (*corev1.ServiceAccount, error) {
+// 	saYAML, err := os.ReadFile(fmt.Sprintf("testdata/serviceaccount/%s.yaml", tc))
+// 	if err != nil {
+// 		return nil, err
+// 	}
+// 	sa := &corev1.ServiceAccount{}
+// 	_ = yaml.Unmarshal(saYAML, sa)
+// 	return sa, nil
+// }
+
+// func TestHorizontalPodAutoscaler(t *testing.T) {
+
+// 	cases := []struct {
+// 		caseName string
+// 		infra    *ir.Infra
+// 		hpa      *egv1a1.KubernetesHorizontalPodAutoscalerSpec
+// 	}{
+// 		{
+// 			caseName: "default",
+// 			infra:    newTestInfra(),
+// 			hpa: &egv1a1.KubernetesHorizontalPodAutoscalerSpec{
+// 				MaxReplicas: ptr.To[int32](1),
+// 			},
+// 		},
+// 		{
+// 			caseName: "custom",
+// 			infra:    newTestInfra(),
+// 			hpa: &egv1a1.KubernetesHorizontalPodAutoscalerSpec{
+// 				MinReplicas: ptr.To[int32](5),
+// 				MaxReplicas: ptr.To[int32](10),
+// 				Metrics: []autoscalingv2.MetricSpec{
+// 					{
+// 						Resource: &autoscalingv2.ResourceMetricSource{
+// 							Name: corev1.ResourceCPU,
+// 							Target: autoscalingv2.MetricTarget{
+// 								Type:               autoscalingv2.UtilizationMetricType,
+// 								AverageUtilization: ptr.To[int32](60),
+// 							},
+// 						},
+// 						Type: autoscalingv2.ResourceMetricSourceType,
+// 					},
+// 					{
+// 						Resource: &autoscalingv2.ResourceMetricSource{
+// 							Name: corev1.ResourceMemory,
+// 							Target: autoscalingv2.MetricTarget{
+// 								Type:               autoscalingv2.UtilizationMetricType,
+// 								AverageUtilization: ptr.To[int32](70),
+// 							},
+// 						},
+// 						Type: autoscalingv2.ResourceMetricSourceType,
+// 					},
+// 				},
+// 			},
+// 		},
+// 	}
+
+// 	for _, tc := range cases {
+// 		t.Run(tc.caseName, func(t *testing.T) {
+// 			provider := tc.infra.GetProxyInfra().GetProxyConfig().GetEnvoyProxyProvider()
+// 			provider.Kubernetes = egv1a1.DefaultEnvoyProxyKubeProvider()
+
+// 			if tc.hpa != nil {
+// 				provider.Kubernetes.EnvoyHpa = tc.hpa
+// 			}
+
+// 			provider.GetEnvoyProxyKubeProvider()
+
+// 			r := NewResourceRender(defaultNamespace, tc.infra.GetProxyInfra())
+// 			hpa, err := r.HorizontalPodAutoscaler()
+// 			require.NoError(t, err)
+
+// 			want, err := loadHPA(tc.caseName)
+// 			require.NoError(t, err)
+
+// 			assert.Equal(t, want, hpa)
+// 		})
+// 	}
+// }
+
+// func loadHPA(caseName string) (*autoscalingv2.HorizontalPodAutoscaler, error) {
+// 	hpaYAML, err := os.ReadFile(fmt.Sprintf("testdata/hpa/%s.yaml", caseName))
+// 	if err != nil {
+// 		return nil, err
+// 	}
+
+// 	hpa := &autoscalingv2.HorizontalPodAutoscaler{}
+// 	_ = yaml.Unmarshal(hpaYAML, hpa)
+// 	return hpa, nil
+// }
+
+// func TestOwningGatewayLabelsAbsent(t *testing.T) {
+
+// 	cases := []struct {
+// 		caseName string
+// 		labels   map[string]string
+// 		expect   bool
+// 	}{
+// 		{
+// 			caseName: "OwningGatewayClassLabel exist, but lack OwningGatewayNameLabel or OwningGatewayNamespaceLabel",
+// 			labels: map[string]string{
+// 				"apk.wso2.com/owning-gatewayclass": "eg-class",
+// 			},
+// 			expect: false,
+// 		},
+// 		{
+// 			caseName: "OwningGatewayNameLabel and OwningGatewayNamespaceLabel exist, but lack OwningGatewayClassLabel",
+// 			labels: map[string]string{
+// 				"apk.wso2.com/owning-gateway-name":      "eg",
+// 				"apk.wso2.com/owning-gateway-namespace": "default",
+// 			},
+// 			expect: false,
+// 		},
+// 		{
+// 			caseName: "OwningGatewayNameLabel exist, but lack OwningGatewayClassLabel and OwningGatewayNamespaceLabel",
+// 			labels: map[string]string{
+// 				"apk.wso2.com/owning-gateway-name": "eg",
+// 			},
+// 			expect: true,
+// 		},
+// 		{
+// 			caseName: "OwningGatewayNamespaceLabel exist, but lack OwningGatewayClassLabel and OwningGatewayNameLabel",
+// 			labels: map[string]string{
+// 				"apk.wso2.com/owning-gateway-namespace": "default",
+// 			},
+// 			expect: true,
+// 		},
+// 		{
+// 			caseName: "lack all labels",
+// 			labels:   map[string]string{},
+// 			expect:   true,
+// 		},
+// 	}
+
+// 	for _, tc := range cases {
+// 		t.Run(tc.caseName, func(t *testing.T) {
+// 			actual := OwningGatewayLabelsAbsent(tc.labels)
+// 			require.Equal(t, tc.expect, actual)
+// 		})
+// 	}
+
+// }
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go
new file mode 100644
index 000000000..de4881c03
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go
@@ -0,0 +1,56 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package proxy
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestEnvoyPodSelector(t *testing.T) {
+	cases := []struct {
+		name     string
+		in       map[string]string
+		expected map[string]string
+	}{
+		{
+			name: "default",
+			in:   map[string]string{"foo": "bar"},
+			expected: map[string]string{
+				"foo":                          "bar",
+				"app.kubernetes.io/name":       "envoy",
+				"app.kubernetes.io/component":  "proxy",
+				"app.kubernetes.io/managed-by": "envoy-gateway",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run("", func(t *testing.T) {
+			got := envoyLabels(tc.in)
+			require.Equal(t, tc.expected, got)
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/default.yaml
new file mode 100644
index 000000000..088b5372c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/default.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+data:
+  xds-certificate.json: '{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret","name":"xds_certificate","tls_certificate":{"certificate_chain":{"filename":"/certs/tls.crt"},"private_key":{"filename":"/certs/tls.key"}}}]}'
+  xds-trusted-ca.json: '{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret","name":"xds_trusted_ca","validation_context":{"trusted_ca":{"filename":"/certs/ca.crt"},"match_typed_subject_alt_names":[{"san_type":"DNS","matcher":{"exact":"envoy-gateway"}}]}}]}'
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/with-annotations.yaml
new file mode 100644
index 000000000..0d2cc9cbd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/with-annotations.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+data:
+  xds-certificate.json: '{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret","name":"xds_certificate","tls_certificate":{"certificate_chain":{"filename":"/certs/tls.crt"},"private_key":{"filename":"/certs/tls.key"}}}]}'
+  xds-trusted-ca.json: '{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret","name":"xds_trusted_ca","validation_context":{"trusted_ca":{"filename":"/certs/ca.crt"},"match_typed_subject_alt_names":[{"san_type":"DNS","matcher":{"exact":"envoy-gateway"}}]}}]}'
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
new file mode 100644
index 000000000..7de7ca171
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
@@ -0,0 +1,296 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
new file mode 100644
index 000000000..7ba4cb464
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
@@ -0,0 +1,297 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        # - --component-log-level filter:info
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
new file mode 100644
index 000000000..dddf49808
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
@@ -0,0 +1,311 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      foo.bar: custom-label
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        foo.bar: custom-label
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        securityContext:
+            privileged: true
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsUser: 1000
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
new file mode 100644
index 000000000..7a3d8264d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
@@ -0,0 +1,328 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 3
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      foo.bar: custom-label
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        foo.bar: custom-label
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+        - mountPath: /lib/filter_foo.so
+          name: custom-libs
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 200m
+            memory: 1Gi
+          limits:
+            cpu: 400m
+            memory: 2Gi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        securityContext:
+          privileged: true
+      dnsPolicy: ClusterFirst
+      initContainers:
+      - args:
+        - echo "Installing filter-foo"; wget -q https://example.com/download/filter_foo_v1.0.0.tgz
+          -O - | tar -xz --directory=/lib filter_foo.so; echo "Done";
+        command:
+        - /bin/sh
+        - -c
+        image: alpine:3.11.3
+        name: install-filter-foo
+        resources: {}
+        volumeMounts:
+        - mountPath: /lib
+          name: custom-libs
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsUser: 1000
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+      - emptyDir: {}
+        name: custom-libs
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
new file mode 100644
index 000000000..b51526666
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
@@ -0,0 +1,310 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        securityContext:
+          privileged: true
+          RunAsUser: 1000
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsUser: 1000
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
new file mode 100644
index 000000000..d459b8da9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
@@ -0,0 +1,296 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
new file mode 100644
index 000000000..a7f68d155
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
@@ -0,0 +1,264 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
new file mode 100644
index 000000000..a7bb21857
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
@@ -0,0 +1,313 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        - name: env_a
+          value: env_a_value
+        - name: env_b
+          value: env_b_value
+        image: envoyproxy/envoy:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0-ubuntu
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        securityContext:
+          privileged: true
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsUser: 1000
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
new file mode 100644
index 000000000..b1086f11d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
@@ -0,0 +1,307 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+    label1: value1
+    label2: value2
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+      label1: value1-override
+      label2: value2
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        anno1: value1-override
+        anno2: value2
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+        label1: value1-override
+        label2: value2
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
new file mode 100644
index 000000000..3ca34b511
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
@@ -0,0 +1,297 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirstWithHostNet
+      hostNetwork: true
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
new file mode 100644
index 000000000..46de0fee6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
@@ -0,0 +1,309 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        - --drain-time-s 30
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        - --ready-timeout=40s
+        command:
+        - envoy-gateway
+        env:
+        - name: env_a
+          value: env_a_value
+        - name: env_b
+          value: env_b_value
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+              - --drain-timeout=30s
+              - --min-drain-duration=15s
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 200m
+            memory: 96Mi
+          requests:
+            cpu: 100m
+            memory: 64Mi
+        securityContext:
+          runAsUser: 1234
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 330
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
new file mode 100644
index 000000000..fe1845ef5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
@@ -0,0 +1,313 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        - name: env_a
+          value: env_a_value
+        - name: env_b
+          value: env_b_value
+        image: envoyproxy/envoy:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        securityContext:
+          privileged: true
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsUser: 1000
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: custom-envoy-cert
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
new file mode 100644
index 000000000..e94ff083e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
@@ -0,0 +1,301 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        anno1: value1
+        anno2: value2
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
new file mode 100644
index 000000000..5ee173a50
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
@@ -0,0 +1,297 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        # - --concurrency 4
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
new file mode 100644
index 000000000..5a358d89e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
@@ -0,0 +1,298 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        # - --key1 val1
+        # - --key2 val2
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
new file mode 100644
index 000000000..cd3821c50
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
@@ -0,0 +1,299 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: aaa
+      - name: bbb
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
new file mode 100644
index 000000000..01ea0267a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
@@ -0,0 +1,299 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      nodeSelector:
+        key1: value1
+        key2: value2
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
new file mode 100644
index 000000000..ab8338bb8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
@@ -0,0 +1,305 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app: foo
+        matchLabelKeys:
+        - pod-template-hash
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/custom.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/custom.yaml
new file mode 100644
index 000000000..274b2b53e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/custom.yaml
@@ -0,0 +1,28 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  maxReplicas: 10
+  metrics:
+  - resource:
+      name: cpu
+      target:
+        averageUtilization: 60
+        type: Utilization
+    type: Resource
+  - resource:
+      name: memory
+      target:
+        averageUtilization: 70
+        type: Utilization
+    type: Resource
+  minReplicas: 5
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: envoy-default-37a8eec1
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/default.yaml
new file mode 100644
index 000000000..f41b6cc45
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/default.yaml
@@ -0,0 +1,21 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  metrics:
+  - resource:
+      name: cpu
+      target:
+        averageUtilization: 80
+        type: Utilization
+    type: Resource
+  maxReplicas: 1
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: envoy-default-37a8eec1
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/with-annotations.yaml
new file mode 100644
index 000000000..61eb91af0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/with-annotations.yaml
@@ -0,0 +1,24 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  labels:
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  metrics:
+    - resource:
+        name: cpu
+        target:
+          averageUtilization: 80
+          type: Utilization
+      type: Resource
+  maxReplicas: 1
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: envoy-default-37a8eec1
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/default.yaml
new file mode 100644
index 000000000..e7da9b590
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/default.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/with-annotations.yaml
new file mode 100644
index 000000000..184fce181
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/with-annotations.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/clusterIP-custom-addresses.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/clusterIP-custom-addresses.yaml
new file mode 100644
index 000000000..6585fe33b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/clusterIP-custom-addresses.yaml
@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  clusterIP: 10.102.168.100
+  clusterIPs:
+    - 10.102.168.100
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  sessionAffinity: None
+  type: ClusterIP
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/custom.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/custom.yaml
new file mode 100644
index 000000000..64f21eb51
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/custom.yaml
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    key1: value1
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  sessionAffinity: None
+  type: ClusterIP
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/default.yaml
new file mode 100644
index 000000000..a859db6e4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/default.yaml
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  externalTrafficPolicy: Local
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  sessionAffinity: None
+  type: LoadBalancer
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/override-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/override-annotations.yaml
new file mode 100644
index 000000000..3f361b1f5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/override-annotations.yaml
@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    anno1: value1-override
+    anno2: value2
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+    label1: value1
+    label2: value2
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  externalTrafficPolicy: Local
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+    label1: value1
+    label2: value2
+  sessionAffinity: None
+  type: LoadBalancer
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/patch-service.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/patch-service.yaml
new file mode 100644
index 000000000..c62c7799c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/patch-service.yaml
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: foo
+  namespace: apk
+spec:
+  externalTrafficPolicy: Local
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  sessionAffinity: None
+  type: LoadBalancer
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/with-annotations.yaml
new file mode 100644
index 000000000..3569d2897
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/with-annotations.yaml
@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  externalTrafficPolicy: Local
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  sessionAffinity: None
+  type: LoadBalancer
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go
new file mode 100644
index 000000000..6a04adc8b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go
@@ -0,0 +1,187 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+var (
+	namespace = "apk"
+)
+
+// func TestCreateOrUpdateProxyConfigMap(t *testing.T) {
+// 	infra := ir.NewInfra()
+// 	infra.Proxy.Name = "test"
+// 	infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+// 	infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = infra.Proxy.Name
+
+// 	testCases := []struct {
+// 		name    string
+// 		current *corev1.ConfigMap
+// 		expect  *corev1.ConfigMap
+// 	}{
+// 		{
+// 			name: "create configmap",
+// 			expect: &corev1.ConfigMap{
+// 				ObjectMeta: metav1.ObjectMeta{
+// 					Namespace: namespace,
+// 					Name:      "envoy-test-9f86d081",
+// 					Labels: map[string]string{
+// 						"app.kubernetes.io/name":               "envoy",
+// 						"app.kubernetes.io/component":          "proxy",
+// 						"app.kubernetes.io/managed-by":         "envoy-gateway",
+// 						gatewayapi.OwningGatewayNamespaceLabel: "default",
+// 						gatewayapi.OwningGatewayNameLabel:      "test",
+// 					},
+// 				},
+// 				Data: map[string]string{
+// 					proxy.SdsCAFilename:   proxy.SdsCAConfigMapData,
+// 					proxy.SdsCertFilename: proxy.SdsCertConfigMapData,
+// 				},
+// 			},
+// 		},
+// 		{
+// 			name: "update configmap",
+// 			current: &corev1.ConfigMap{
+// 				ObjectMeta: metav1.ObjectMeta{
+// 					Namespace: namespace,
+// 					Name:      "envoy-test",
+// 					Labels: map[string]string{
+// 						"app.kubernetes.io/name":               "envoy",
+// 						"app.kubernetes.io/component":          "proxy",
+// 						"app.kubernetes.io/managed-by":         "envoy-gateway",
+// 						gatewayapi.OwningGatewayNamespaceLabel: "default",
+// 						gatewayapi.OwningGatewayNameLabel:      "test",
+// 					},
+// 				},
+// 				Data: map[string]string{"foo": "bar"},
+// 			},
+// 			expect: &corev1.ConfigMap{
+// 				ObjectMeta: metav1.ObjectMeta{
+// 					Namespace: namespace,
+// 					Name:      "envoy-test-9f86d081",
+// 					Labels: map[string]string{
+// 						"app.kubernetes.io/name":               "envoy",
+// 						"app.kubernetes.io/component":          "proxy",
+// 						"app.kubernetes.io/managed-by":         "envoy-gateway",
+// 						gatewayapi.OwningGatewayNamespaceLabel: "default",
+// 						gatewayapi.OwningGatewayNameLabel:      "test",
+// 					},
+// 				},
+// 				Data: map[string]string{
+// 					proxy.SdsCAFilename:   proxy.SdsCAConfigMapData,
+// 					proxy.SdsCertFilename: proxy.SdsCertConfigMapData,
+// 				},
+// 			},
+// 		},
+// 	}
+
+// 	for _, tc := range testCases {
+// 		tc := tc
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			var cli client.Client
+// 			if tc.current != nil {
+// 				cli = fakeclient.NewClientBuilder().WithObjects(tc.current).Build()
+// 			} else {
+// 				cli = fakeclient.NewClientBuilder().Build()
+// 			}
+// 			kube := NewInfra(cli)
+// 			r := proxy.NewResourceRender(kube.Namespace, infra.GetProxyInfra())
+// 			err := kube.createOrUpdateConfigMap(context.Background(), r)
+// 			require.NoError(t, err)
+// 			actual := &corev1.ConfigMap{
+// 				ObjectMeta: metav1.ObjectMeta{
+// 					Namespace: tc.expect.Namespace,
+// 					Name:      tc.expect.Name,
+// 				},
+// 			}
+// 			require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(actual), actual))
+// 			require.Equal(t, tc.expect.Data, actual.Data)
+// 			assert.True(t, apiequality.Semantic.DeepEqual(tc.expect.Labels, actual.Labels))
+// 		})
+// 	}
+// }
+
+func TestDeleteConfigProxyMap(t *testing.T) {
+
+	infra := ir.NewInfra()
+	infra.Proxy.Name = "test"
+
+	testCases := []struct {
+		name    string
+		current *corev1.ConfigMap
+		expect  bool
+	}{
+		{
+			name: "delete configmap",
+			current: &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: namespace,
+					Name:      "envoy-test",
+				},
+			},
+			expect: true,
+		},
+		{
+			name: "configmap not found",
+			current: &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: namespace,
+					Name:      "foo",
+				},
+			},
+			expect: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			cli := fakeclient.NewClientBuilder().WithObjects(tc.current).Build()
+			kube := NewInfra(cli)
+
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = infra.Proxy.Name
+
+			r := proxy.NewResourceRender(kube.Namespace, infra.GetProxyInfra())
+			cm := &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: kube.Namespace,
+					Name:      r.Name(),
+				},
+			}
+			err := kube.Client.Delete(context.Background(), cm)
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_deployment_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_deployment_test.go
new file mode 100644
index 000000000..15966b478
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_deployment_test.go
@@ -0,0 +1,162 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	appsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+const (
+	// envoyContainerName is the name of the Envoy container.
+	envoyContainerName = "envoy"
+)
+
+func deploymentWithImage(deploy *appsv1.Deployment, image string) *appsv1.Deployment {
+	dCopy := deploy.DeepCopy()
+	for i, c := range dCopy.Spec.Template.Spec.Containers {
+		if c.Name == envoyContainerName {
+			dCopy.Spec.Template.Spec.Containers[i].Image = image
+		}
+	}
+	return dCopy
+}
+
+func TestCreateOrUpdateProxyDeployment(t *testing.T) {
+
+	infra := ir.NewInfra()
+	infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+	infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = infra.Proxy.Name
+
+	r := proxy.NewResourceRender("", infra.GetProxyInfra())
+	deploy, err := r.Deployment()
+	require.NoError(t, err)
+
+	testCases := []struct {
+		name    string
+		in      *ir.Infra
+		current *appsv1.Deployment
+		want    *appsv1.Deployment
+	}{
+		{
+			name: "create deployment",
+			in:   infra,
+			want: deploy,
+		},
+		{
+			name:    "deployment exists",
+			in:      infra,
+			current: deploy,
+			want:    deploy,
+		},
+		{
+			name: "update deployment image",
+			in: &ir.Infra{
+				Proxy: &ir.ProxyInfra{
+					Metadata: &ir.InfraMetadata{
+						Labels: map[string]string{
+							gatewayapi.OwningGatewayNamespaceLabel: "default",
+							gatewayapi.OwningGatewayNameLabel:      infra.Proxy.Name,
+						},
+					},
+					Name:      ir.DefaultProxyName,
+					Listeners: ir.NewProxyListeners(),
+				},
+			},
+			current: deploy,
+			want:    deploy,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			var cli client.Client
+			if tc.current != nil {
+				cli = fakeclient.NewClientBuilder().WithObjects(tc.current).Build()
+			} else {
+				cli = fakeclient.NewClientBuilder().Build()
+			}
+
+			kube := NewInfra(cli)
+			r := proxy.NewResourceRender(kube.Namespace, tc.in.GetProxyInfra())
+			err := kube.createOrUpdateDeployment(context.Background(), r)
+			require.NoError(t, err)
+
+			actual := &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: kube.Namespace,
+					Name:      proxy.ExpectedResourceHashedName(tc.in.Proxy.Name),
+				},
+			}
+			require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(actual), actual))
+			require.Equal(t, tc.want.Spec, actual.Spec)
+		})
+	}
+}
+
+func TestDeleteProxyDeployment(t *testing.T) {
+	cli := fakeclient.NewClientBuilder().WithObjects().Build()
+
+	testCases := []struct {
+		name   string
+		expect bool
+	}{
+		{
+			name:   "delete deployment",
+			expect: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			kube := NewInfra(cli)
+
+			infra := ir.NewInfra()
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = infra.Proxy.Name
+			r := proxy.NewResourceRender(kube.Namespace, infra.GetProxyInfra())
+
+			err := kube.createOrUpdateDeployment(context.Background(), r)
+			require.NoError(t, err)
+			deployment := &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: kube.Namespace,
+					Name:      r.Name(),
+				},
+			}
+			err = kube.Client.Delete(context.Background(), deployment)
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra.go
new file mode 100644
index 000000000..ab898ea02
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra.go
@@ -0,0 +1,55 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"errors"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+)
+
+// CreateOrUpdateProxyInfra creates the managed kube infra, if it doesn't exist.
+func (i *Infra) CreateOrUpdateProxyInfra(ctx context.Context, infra *ir.Infra) error {
+	if infra == nil {
+		return errors.New("infra ir is nil")
+	}
+
+	if infra.Proxy == nil {
+		return errors.New("infra proxy ir is nil")
+	}
+
+	r := proxy.NewResourceRender(i.Namespace, infra.GetProxyInfra())
+	return i.createOrUpdate(ctx, r)
+}
+
+// DeleteProxyInfra removes the managed kube infra, if it doesn't exist.
+func (i *Infra) DeleteProxyInfra(ctx context.Context, infra *ir.Infra) error {
+	if infra == nil {
+		return errors.New("infra ir is nil")
+	}
+
+	r := proxy.NewResourceRender(i.Namespace, infra.GetProxyInfra())
+	return i.delete(ctx, r)
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra_test.go
new file mode 100644
index 000000000..cd3827f27
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra_test.go
@@ -0,0 +1,180 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+func newTestInfra(t *testing.T) *Infra {
+	cli := fakeclient.NewClientBuilder().Build()
+	return newTestInfraWithClient(t, cli)
+}
+
+func TestCmpBytes(t *testing.T) {
+	m1 := map[string][]byte{}
+	m1["a"] = []byte("aaa")
+	m2 := map[string][]byte{}
+	m2["a"] = []byte("aaa")
+
+	assert.True(t, reflect.DeepEqual(m1, m2))
+	assert.False(t, reflect.DeepEqual(nil, m2))
+	assert.False(t, reflect.DeepEqual(m1, nil))
+}
+
+func newTestInfraWithClient(t *testing.T, cli client.Client) *Infra {
+	return NewInfra(cli)
+}
+
+func TestCreateProxyInfra(t *testing.T) {
+	// Infra with Gateway owner labels.
+	infraWithLabels := ir.NewInfra()
+	infraWithLabels.GetProxyInfra().GetProxyMetadata().Labels = proxy.EnvoyAppLabel()
+	infraWithLabels.GetProxyInfra().GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+	infraWithLabels.GetProxyInfra().GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = "test-gw"
+
+	testCases := []struct {
+		name   string
+		in     *ir.Infra
+		expect bool
+	}{
+		{
+			name:   "infra-with-expected-labels",
+			in:     infraWithLabels,
+			expect: true,
+		},
+		{
+			name:   "default infra without Gateway owner labels",
+			in:     ir.NewInfra(),
+			expect: false,
+		},
+		{
+			name:   "nil-infra",
+			in:     nil,
+			expect: false,
+		},
+		{
+			name: "nil-infra-proxy",
+			in: &ir.Infra{
+				Proxy: nil,
+			},
+			expect: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			kube := newTestInfra(t)
+			// Create or update the proxy infra.
+			err := kube.CreateOrUpdateProxyInfra(context.Background(), tc.in)
+			if !tc.expect {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+
+				// Verify all resources were created via the fake kube client.
+				sa := &corev1.ServiceAccount{
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace: kube.Namespace,
+						Name:      proxy.ExpectedResourceHashedName(tc.in.Proxy.Name),
+					},
+				}
+				require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(sa), sa))
+
+				// cm := &corev1.ConfigMap{
+				// 	ObjectMeta: metav1.ObjectMeta{
+				// 		Namespace: kube.Namespace,
+				// 		Name:      proxy.ExpectedResourceHashedName(tc.in.Proxy.Name),
+				// 	},
+				// }
+				// require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(cm), cm))
+
+				deploy := &appsv1.Deployment{
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace: kube.Namespace,
+						Name:      proxy.ExpectedResourceHashedName(tc.in.Proxy.Name),
+					},
+				}
+				require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(deploy), deploy))
+
+				svc := &corev1.Service{
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace: kube.Namespace,
+						Name:      proxy.ExpectedResourceHashedName(tc.in.Proxy.Name),
+					},
+				}
+				require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(svc), svc))
+			}
+		})
+	}
+}
+
+func TestDeleteProxyInfra(t *testing.T) {
+
+	testCases := []struct {
+		name   string
+		in     *ir.Infra
+		expect bool
+	}{
+		{
+			name:   "nil infra",
+			in:     nil,
+			expect: false,
+		},
+		{
+			name:   "default infra",
+			in:     ir.NewInfra(),
+			expect: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			kube := newTestInfra(t)
+
+			err := kube.DeleteProxyInfra(context.Background(), tc.in)
+			if !tc.expect {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_service_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_service_test.go
new file mode 100644
index 000000000..f5fea49d2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_service_test.go
@@ -0,0 +1,60 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+)
+
+func TestDeleteProxyService(t *testing.T) {
+	testCases := []struct {
+		name string
+	}{
+		{
+			name: "delete service",
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			kube := newTestInfra(t)
+			infra := ir.NewInfra()
+
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = infra.Proxy.Name
+			r := proxy.NewResourceRender(kube.Namespace, infra.GetProxyInfra())
+			err := kube.createOrUpdateService(context.Background(), r)
+			require.NoError(t, err)
+
+			err = kube.deleteService(context.Background(), r)
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource.go
new file mode 100644
index 000000000..06c672157
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource.go
@@ -0,0 +1,131 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package resource
+
+import (
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+)
+
+// GetSelector returns a label selector used to select resources
+// based on the provided labels.
+func GetSelector(labels map[string]string) *metav1.LabelSelector {
+	return &metav1.LabelSelector{
+		MatchLabels: labels,
+	}
+}
+
+// ExpectedServiceSpec returns service spec.
+func ExpectedServiceSpec(service *egv1a1.KubernetesServiceSpec) corev1.ServiceSpec {
+	serviceSpec := corev1.ServiceSpec{}
+	serviceSpec.Type = corev1.ServiceType(*service.Type)
+	serviceSpec.SessionAffinity = corev1.ServiceAffinityNone
+	if service.ExternalTrafficPolicy == nil {
+		service.ExternalTrafficPolicy = egv1a1.DefaultKubernetesServiceExternalTrafficPolicy()
+	}
+	if *service.Type == egv1a1.ServiceTypeLoadBalancer {
+		if service.LoadBalancerClass != nil {
+			serviceSpec.LoadBalancerClass = service.LoadBalancerClass
+		}
+		if service.AllocateLoadBalancerNodePorts != nil {
+			serviceSpec.AllocateLoadBalancerNodePorts = service.AllocateLoadBalancerNodePorts
+		}
+		if service.LoadBalancerIP != nil {
+			serviceSpec.LoadBalancerIP = *service.LoadBalancerIP
+		}
+		serviceSpec.ExternalTrafficPolicy = corev1.ServiceExternalTrafficPolicy(*service.ExternalTrafficPolicy)
+	}
+
+	return serviceSpec
+}
+
+// CompareSvc compares the Service resource and ignores specific fields that may have been modified by other actors.
+func CompareSvc(currentSvc, originalSvc *corev1.Service) bool {
+	return cmp.Equal(currentSvc.Spec, originalSvc.Spec,
+		cmpopts.IgnoreFields(corev1.ServicePort{}, "NodePort"),
+		cmpopts.IgnoreFields(corev1.ServiceSpec{}, "ClusterIP", "ClusterIPs"),
+		cmpopts.IgnoreFields(metav1.ObjectMeta{}, "Finalizers"))
+}
+
+// ExpectedContainerEnv returns expected container envs.
+func ExpectedContainerEnv(container *egv1a1.KubernetesContainerSpec, env []corev1.EnvVar) []corev1.EnvVar {
+	amendFunc := func(envVar corev1.EnvVar) {
+		for index, e := range env {
+			if e.Name == envVar.Name {
+				env[index] = envVar
+				return
+			}
+		}
+		env = append(env, envVar)
+	}
+
+	for _, envVar := range container.Env {
+		amendFunc(envVar)
+	}
+
+	return env
+}
+
+// ExpectedDeploymentVolumes returns expected deployment volumes.
+func ExpectedDeploymentVolumes(pod *egv1a1.KubernetesPodSpec, volumes []corev1.Volume) []corev1.Volume {
+	amendFunc := func(volume corev1.Volume) {
+		for index, e := range volumes {
+			if e.Name == volume.Name {
+				volumes[index] = volume
+				return
+			}
+		}
+
+		volumes = append(volumes, volume)
+	}
+
+	for _, envVar := range pod.Volumes {
+		amendFunc(envVar)
+	}
+
+	return volumes
+}
+
+// ExpectedContainerVolumeMounts returns expected container volume mounts.
+func ExpectedContainerVolumeMounts(container *egv1a1.KubernetesContainerSpec, volumeMounts []corev1.VolumeMount) []corev1.VolumeMount {
+	amendFunc := func(volumeMount corev1.VolumeMount) {
+		for index, e := range volumeMounts {
+			if e.Name == volumeMount.Name {
+				volumeMounts[index] = volumeMount
+				return
+			}
+		}
+
+		volumeMounts = append(volumeMounts, volumeMount)
+	}
+
+	for _, volumeMount := range container.VolumeMounts {
+		amendFunc(volumeMount)
+	}
+
+	return volumeMounts
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go
new file mode 100644
index 000000000..619459000
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go
@@ -0,0 +1,553 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package resource
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
+
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+)
+
+func TestExpectedServiceSpec(t *testing.T) {
+	type args struct {
+		service *egv1a1.KubernetesServiceSpec
+	}
+	loadbalancerClass := "foobar"
+	tests := []struct {
+		name string
+		args args
+		want corev1.ServiceSpec
+	}{
+		{
+			name: "LoadBalancer",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type: egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+			}},
+			want: corev1.ServiceSpec{
+				Type:                  corev1.ServiceTypeLoadBalancer,
+				SessionAffinity:       corev1.ServiceAffinityNone,
+				ExternalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeLocal,
+			},
+		},
+		{
+			name: "LoadBalancerWithExternalTrafficPolicyCluster",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type:                  egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+				ExternalTrafficPolicy: egv1a1.GetKubernetesServiceExternalTrafficPolicy(egv1a1.ServiceExternalTrafficPolicyCluster),
+			}},
+			want: corev1.ServiceSpec{
+				Type:                  corev1.ServiceTypeLoadBalancer,
+				SessionAffinity:       corev1.ServiceAffinityNone,
+				ExternalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeCluster,
+			},
+		},
+		{
+			name: "LoadBalancerWithClass",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type:              egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+				LoadBalancerClass: &loadbalancerClass,
+			}},
+			want: corev1.ServiceSpec{
+				Type:                  corev1.ServiceTypeLoadBalancer,
+				LoadBalancerClass:     &loadbalancerClass,
+				SessionAffinity:       corev1.ServiceAffinityNone,
+				ExternalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeLocal,
+			},
+		},
+		{
+			name: "LoadBalancerWithAllocateLoadBalancerNodePorts",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type:                          egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+				AllocateLoadBalancerNodePorts: ptr.To(true),
+			}},
+			want: corev1.ServiceSpec{
+				Type:                          corev1.ServiceTypeLoadBalancer,
+				AllocateLoadBalancerNodePorts: ptr.To(true),
+				SessionAffinity:               corev1.ServiceAffinityNone,
+				ExternalTrafficPolicy:         corev1.ServiceExternalTrafficPolicyTypeLocal,
+			},
+		},
+		{
+			name: "LoadBalancerWithLoadBalancerIP",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type:           egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+				LoadBalancerIP: ptr.To("10.11.12.13"),
+			}},
+			want: corev1.ServiceSpec{
+				Type:                  corev1.ServiceTypeLoadBalancer,
+				LoadBalancerIP:        "10.11.12.13",
+				SessionAffinity:       corev1.ServiceAffinityNone,
+				ExternalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeLocal,
+			},
+		},
+		{
+			name: "ClusterIP",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type: egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeClusterIP),
+			}},
+			want: corev1.ServiceSpec{
+				Type:            corev1.ServiceTypeClusterIP,
+				SessionAffinity: corev1.ServiceAffinityNone,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, ExpectedServiceSpec(tt.args.service), "expectedServiceSpec(%v)", tt.args.service)
+		})
+	}
+}
+
+func TestGetSelector(t *testing.T) {
+	cases := []struct {
+		name     string
+		in       map[string]string
+		expected map[string]string
+	}{
+		{
+			name: "proxy",
+			in: map[string]string{
+				"app.kubernetes.io/name":       "envoy",
+				"app.kubernetes.io/component":  "proxy",
+				"app.kubernetes.io/managed-by": "envoy-gateway",
+			},
+			expected: map[string]string{
+				"app.kubernetes.io/name":       "envoy",
+				"app.kubernetes.io/component":  "proxy",
+				"app.kubernetes.io/managed-by": "envoy-gateway",
+			},
+		},
+		{
+			name: "ratelimit",
+			in: map[string]string{
+				"app.kubernetes.io/name":       "envoy-ratelimit",
+				"app.kubernetes.io/component":  "ratelimit",
+				"app.kubernetes.io/managed-by": "envoy-gateway",
+			},
+			expected: map[string]string{
+				"app.kubernetes.io/name":       "envoy-ratelimit",
+				"app.kubernetes.io/component":  "ratelimit",
+				"app.kubernetes.io/managed-by": "envoy-gateway",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run("", func(t *testing.T) {
+			got := GetSelector(tc.in)
+			require.Equal(t, tc.expected, got.MatchLabels)
+		})
+	}
+}
+
+func TestCompareSvc(t *testing.T) {
+	cases := []struct {
+		ExpectRet   bool
+		NewSvc      *corev1.Service
+		OriginalSvc *corev1.Service
+	}{
+		{
+			// Only Spec.Ports[*].NodePort and ClusterType is different
+			ExpectRet: true,
+			NewSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							NodePort:   30000,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "NodePort",
+				},
+			},
+			OriginalSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							NodePort:   30001,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "NodePort",
+				},
+			},
+		}, {
+			// Only Spec.Ports[*].Port is different
+			ExpectRet: false,
+			NewSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+			OriginalSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       90,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+		},
+		{
+			// only Spec.ClusterIP is different, NewSvc's ClusterIP is nil build by ResourceRender
+			ExpectRet: true,
+			NewSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					ClusterIP: "",
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+			OriginalSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					ClusterIP: "192.168.1.1",
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+		}, {
+			// Finalizers field differs
+			ExpectRet: true,
+			NewSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "my-service",
+					Namespace:  "default",
+					Finalizers: []string{"service.k8s.aws/resources"},
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+			OriginalSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run("", func(t *testing.T) {
+			assert.Equal(t, tc.ExpectRet, CompareSvc(tc.NewSvc, tc.OriginalSvc), "expectedCompareSvcReturn(%v)", tc.ExpectRet)
+		})
+	}
+}
+
+func TestExpectedProxyContainerEnv(t *testing.T) {
+	type args struct {
+		container *egv1a1.KubernetesContainerSpec
+		env       []corev1.EnvVar
+	}
+	tests := []struct {
+		name string
+		args args
+		want []corev1.EnvVar
+	}{
+		{
+			name: "TestExpectedProxyContainerEnv",
+			args: args{
+				container: &egv1a1.KubernetesContainerSpec{
+					Env: []corev1.EnvVar{
+						{
+							Name:  "env_a",
+							Value: "override_env_a_value",
+						},
+						{
+							Name:  "env_b",
+							Value: "override_env_a_value",
+						},
+						{
+							Name:  "env_c",
+							Value: "new_env_c_value",
+						},
+					},
+				},
+				env: []corev1.EnvVar{
+					{
+						Name:  "env_a",
+						Value: "default_env_a_value",
+					},
+					{
+						Name:  "env_b",
+						Value: "default_env_a_value",
+					},
+					{
+						Name:  "default_env",
+						Value: "default_env_value",
+					},
+				},
+			},
+			want: []corev1.EnvVar{
+				{
+					Name:  "env_a",
+					Value: "override_env_a_value",
+				},
+				{
+					Name:  "env_b",
+					Value: "override_env_a_value",
+				},
+				{
+					Name:  "default_env",
+					Value: "default_env_value",
+				},
+				{
+					Name:  "env_c",
+					Value: "new_env_c_value",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, ExpectedContainerEnv(tt.args.container, tt.args.env), "ExpectedProxyContainerEnv(%v, %v)", tt.args.container, tt.args.env)
+		})
+	}
+}
+
+func TestExpectedDeploymentVolumes(t *testing.T) {
+	type args struct {
+		pod     *egv1a1.KubernetesPodSpec
+		volumes []corev1.Volume
+	}
+	tests := []struct {
+		name string
+		args args
+		want []corev1.Volume
+	}{
+		{
+			name: "TestExpectedDeploymentVolumes",
+			args: args{
+				pod: &egv1a1.KubernetesPodSpec{
+					Volumes: []corev1.Volume{
+						{
+							Name: "certs",
+							VolumeSource: corev1.VolumeSource{
+								Secret: &corev1.SecretVolumeSource{
+									SecretName: "override-cert",
+								},
+							},
+						},
+					},
+				},
+				volumes: []corev1.Volume{
+					{
+						Name: "certs",
+						VolumeSource: corev1.VolumeSource{
+							Secret: &corev1.SecretVolumeSource{
+								SecretName: "cert",
+							},
+						},
+					},
+					{
+						Name: "default-certs",
+						VolumeSource: corev1.VolumeSource{
+							Secret: &corev1.SecretVolumeSource{
+								SecretName: "default-cert",
+							},
+						},
+					},
+				},
+			},
+			want: []corev1.Volume{
+				{
+					Name: "certs",
+					VolumeSource: corev1.VolumeSource{
+						Secret: &corev1.SecretVolumeSource{
+							SecretName: "override-cert",
+						},
+					},
+				},
+				{
+					Name: "default-certs",
+					VolumeSource: corev1.VolumeSource{
+						Secret: &corev1.SecretVolumeSource{
+							SecretName: "default-cert",
+						},
+					},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, ExpectedDeploymentVolumes(tt.args.pod, tt.args.volumes), "ExpectedDeploymentVolumes(%v, %v)", tt.args.pod, tt.args.volumes)
+		})
+	}
+}
+
+func TestExpectedContainerVolumeMounts(t *testing.T) {
+	type args struct {
+		container    *egv1a1.KubernetesContainerSpec
+		volumeMounts []corev1.VolumeMount
+	}
+	tests := []struct {
+		name string
+		args args
+		want []corev1.VolumeMount
+	}{
+		{
+			name: "TestExpectedContainerVolumeMounts",
+			args: args{
+				container: &egv1a1.KubernetesContainerSpec{
+					VolumeMounts: []corev1.VolumeMount{
+						{
+							Name:      "certs",
+							MountPath: "/override-certs",
+							ReadOnly:  true,
+						},
+					},
+				},
+				volumeMounts: []corev1.VolumeMount{
+					{
+						Name:      "certs",
+						MountPath: "/certs",
+						ReadOnly:  true,
+					},
+					{
+						Name:      "default-certs",
+						MountPath: "/default-certs",
+						ReadOnly:  true,
+					},
+				},
+			},
+			want: []corev1.VolumeMount{
+				{
+					Name:      "certs",
+					MountPath: "/override-certs",
+					ReadOnly:  true,
+				},
+				{
+					Name:      "default-certs",
+					MountPath: "/default-certs",
+					ReadOnly:  true,
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, ExpectedContainerVolumeMounts(tt.args.container, tt.args.volumeMounts), "ExpectedContainerVolumeMounts(%v, %v)", tt.args.container, tt.args.volumeMounts)
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/manager.go b/adapter/internal/operator/gateway-api/infrastructure/manager.go
new file mode 100644
index 000000000..40e902b10
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/manager.go
@@ -0,0 +1,57 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package infrastructure
+
+import (
+	"context"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	clicfg "sigs.k8s.io/controller-runtime/pkg/client/config"
+)
+
+var _ Manager = (*kubernetes.Infra)(nil)
+
+// Manager provides the scaffolding for managing infrastructure.
+type Manager interface {
+	// CreateOrUpdateProxyInfra creates or updates infra.
+	CreateOrUpdateProxyInfra(ctx context.Context, infra *ir.Infra) error
+	// DeleteProxyInfra deletes infra.
+	DeleteProxyInfra(ctx context.Context, infra *ir.Infra) error
+	// // CreateOrUpdateRateLimitInfra creates or updates rate limit infra.
+	// CreateOrUpdateRateLimitInfra(ctx context.Context) error
+	// DeleteRateLimitInfra deletes rate limit infra.
+	// DeleteRateLimitInfra(ctx context.Context) error
+}
+
+// NewManager returns a new infrastructure Manager.
+func NewManager() (Manager, error) {
+	var mgr Manager
+	cli, err := client.New(clicfg.GetConfigOrDie(), client.Options{})
+	if err != nil {
+		return nil, err
+	}
+	mgr = kubernetes.NewInfra(cli)
+	return mgr, nil
+}
diff --git a/adapter/internal/operator/gateway-api/ir/infra.go b/adapter/internal/operator/gateway-api/ir/infra.go
new file mode 100644
index 000000000..f679e68ec
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/infra.go
@@ -0,0 +1,274 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package ir
+
+import (
+	"cmp"
+	"errors"
+	"fmt"
+	"reflect"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	"golang.org/x/exp/slices"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"sigs.k8s.io/yaml"
+)
+
+const (
+	DefaultProxyName = "default"
+)
+
+// Infra defines managed infrastructure.
+// +k8s:deepcopy-gen=true
+type Infra struct {
+	// Proxy defines managed proxy infrastructure.
+	Proxy *ProxyInfra `json:"proxy" yaml:"proxy"`
+}
+
+func (i Infra) YAMLString() string {
+	y, _ := yaml.Marshal(&i)
+	return string(y)
+}
+
+// ProxyInfra defines managed proxy infrastructure.
+// +k8s:deepcopy-gen=true
+type ProxyInfra struct {
+	// Metadata defines metadata for the managed proxy infrastructure.
+	Metadata *InfraMetadata `json:"metadata,omitempty" yaml:"metadata,omitempty"`
+	// Name is the name used for managed proxy infrastructure.
+	Name string `json:"name" yaml:"name"`
+	// Config defines user-facing configuration of the managed proxy infrastructure.
+	Config *v1alpha1.EnvoyProxy `json:"config,omitempty" yaml:"config,omitempty"`
+	// Listeners define the listeners exposed by the proxy infrastructure.
+	Listeners []*ProxyListener `json:"listeners,omitempty" yaml:"listeners,omitempty"`
+	// Addresses contain the external addresses this gateway has been
+	// requested to be available at.
+	Addresses []string `json:"addresses,omitempty" yaml:"addresses,omitempty"`
+}
+
+// InfraMetadata defines metadata for the managed proxy infrastructure.
+// +k8s:deepcopy-gen=true
+type InfraMetadata struct {
+	// Annotations define a map of string keys and values that can be used to
+	// organize and categorize proxy infrastructure objects.
+	Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
+	// Labels define a map of string keys and values that can be used to organize
+	// and categorize proxy infrastructure objects.
+	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
+}
+
+// ProxyListener defines the listener configuration of the proxy infrastructure.
+// +k8s:deepcopy-gen=true
+type ProxyListener struct {
+	// Name of the ProxyListener
+	Name string `json:"name" yaml:"name"`
+	// Address is the address that the listener should listen on.
+	Address *string `json:"address" yaml:"address"`
+	// Ports define network ports of the listener.
+	Ports []ListenerPort `json:"ports,omitempty" yaml:"ports,omitempty"`
+	// HTTP3 provides HTTP/3 configuration on the listener.
+	// +optional
+	HTTP3 *HTTP3Settings `json:"http3,omitempty"`
+}
+
+// HTTP3Settings provides HTTP/3 configuration on the listener.
+type HTTP3Settings struct {
+	QUICPort int32 `json:"quicPort" yaml:"quicPort"`
+}
+
+// ListenerPort defines a network port of a listener.
+// +k8s:deepcopy-gen=true
+type ListenerPort struct {
+	// Name is the name of the listener port.
+	Name string `json:"name" yaml:"name"`
+	// Protocol is the protocol that the listener port will listener for.
+	Protocol ProtocolType `json:"protocol" yaml:"protocol"`
+	// ServicePort is the port number the proxy service is listening on.
+	ServicePort int32 `json:"servicePort" yaml:"servicePort"`
+	// ContainerPort is the port number the proxy container is listening on.
+	ContainerPort int32 `json:"containerPort" yaml:"containerPort"`
+}
+
+// ProtocolType defines the application protocol accepted by a ListenerPort.
+//
+// Valid values include "HTTP" and "HTTPS".
+type ProtocolType string
+
+const (
+	// HTTPProtocolType accepts cleartext HTTP/1.1 sessions over TCP or HTTP/2
+	// over cleartext.
+	HTTPProtocolType ProtocolType = "HTTP"
+
+	// HTTPSProtocolType accepts HTTP/1.1 or HTTP/2 sessions over TLS.
+	HTTPSProtocolType ProtocolType = "HTTPS"
+
+	// TLSProtocolType accepts TLS sessions over TCP.
+	TLSProtocolType ProtocolType = "TLS"
+
+	// TCPProtocolType accepts TCP connection.
+	TCPProtocolType ProtocolType = "TCP"
+
+	// UDPProtocolType accepts UDP connection.
+	UDPProtocolType ProtocolType = "UDP"
+)
+
+// NewInfra returns a new Infra with default parameters.
+func NewInfra() *Infra {
+	return &Infra{
+		Proxy: NewProxyInfra(),
+	}
+}
+
+// NewProxyInfra returns a new ProxyInfra with default parameters.
+func NewProxyInfra() *ProxyInfra {
+	return &ProxyInfra{
+		Metadata: NewInfraMetadata(),
+		Name:     DefaultProxyName,
+	}
+}
+
+// NewProxyListeners returns a new slice of ProxyListener with default parameters.
+func NewProxyListeners() []*ProxyListener {
+	return []*ProxyListener{
+		{
+			Ports: nil,
+		},
+	}
+}
+
+// NewInfraMetadata returns a new InfraMetadata.
+func NewInfraMetadata() *InfraMetadata {
+	return &InfraMetadata{
+		Labels: map[string]string{},
+	}
+}
+
+// GetProxyInfra returns the ProxyInfra.
+func (i *Infra) GetProxyInfra() *ProxyInfra {
+	if i.Proxy == nil {
+		i.Proxy = NewProxyInfra()
+		return i.Proxy
+	}
+	if len(i.Proxy.Name) == 0 {
+		i.Proxy.Name = DefaultProxyName
+	}
+	if len(i.Proxy.Listeners) == 0 {
+		i.Proxy.Listeners = NewProxyListeners()
+	}
+	if i.Proxy.Metadata == nil {
+		i.Proxy.Metadata = NewInfraMetadata()
+	}
+
+	return i.Proxy
+}
+
+// GetProxyMetadata returns the InfraMetadata.
+func (p *ProxyInfra) GetProxyMetadata() *InfraMetadata {
+	if p.Metadata == nil {
+		p.Metadata = NewInfraMetadata()
+	}
+
+	return p.Metadata
+}
+
+// GetProxyConfig returns the ProxyInfra config.
+func (p *ProxyInfra) GetProxyConfig() *v1alpha1.EnvoyProxy {
+	if p.Config == nil {
+		p.Config = new(v1alpha1.EnvoyProxy)
+	}
+
+	return p.Config
+}
+
+// Validate validates the provided Infra.
+func (i *Infra) Validate() error {
+	if i == nil {
+		return errors.New("infra ir is nil")
+	}
+
+	var errs []error
+
+	if i.Proxy != nil {
+		if err := i.Proxy.Validate(); err != nil {
+			errs = append(errs, err)
+		}
+	}
+
+	return utilerrors.NewAggregate(errs)
+}
+
+// Validate validates the provided ProxyInfra.
+func (p *ProxyInfra) Validate() error {
+	var errs []error
+
+	if len(p.Name) == 0 {
+		errs = append(errs, errors.New("name field required"))
+	}
+
+	if len(p.Listeners) > 0 {
+		for i := range p.Listeners {
+			listener := p.Listeners[i]
+			if len(listener.Ports) == 0 {
+				errs = append(errs, errors.New("listener ports field required"))
+			}
+			for j := range listener.Ports {
+				if len(listener.Ports[j].Name) == 0 {
+					errs = append(errs, errors.New("listener name field required"))
+				}
+				if listener.Ports[j].ServicePort < 1 || listener.Ports[j].ServicePort > 65353 {
+					errs = append(errs, errors.New("listener service port must be a valid port number"))
+				}
+				if listener.Ports[j].ContainerPort < 1024 || listener.Ports[j].ContainerPort > 65353 {
+					errs = append(errs, errors.New("listener container port must be a valid ephemeral port number"))
+				}
+			}
+		}
+	}
+
+	return utilerrors.NewAggregate(errs)
+}
+
+// ObjectName returns the name of the proxy infrastructure object.
+func (p *ProxyInfra) ObjectName() string {
+	if len(p.Name) == 0 {
+		return fmt.Sprintf("envoy-%s", DefaultProxyName)
+	}
+	return "envoy-" + p.Name
+}
+
+// Equal implements the Comparable interface used by watchable.DeepEqual to skip unnecessary updates.
+func (p *ProxyInfra) Equal(y *ProxyInfra) bool {
+	// Deep copy to avoid modifying the original ordering.
+	p = p.DeepCopy()
+	p.sort()
+	y = y.DeepCopy()
+	y.sort()
+	return reflect.DeepEqual(p, y)
+}
+
+// sort ensures the listeners are in a consistent order.
+func (p *ProxyInfra) sort() {
+	slices.SortFunc(p.Listeners, func(l1, l2 *ProxyListener) int {
+		return cmp.Compare(l1.Name, l2.Name)
+	})
+}
diff --git a/adapter/internal/operator/gateway-api/ir/infra_test.go b/adapter/internal/operator/gateway-api/ir/infra_test.go
new file mode 100644
index 000000000..d87e2836d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/infra_test.go
@@ -0,0 +1,263 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package ir
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateInfra(t *testing.T) {
+	testCases := []struct {
+		name   string
+		infra  *Infra
+		expect bool
+	}{
+		{
+			name:   "default",
+			infra:  NewInfra(),
+			expect: true,
+		},
+		{
+			name: "no-name",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name:      "",
+					Listeners: NewProxyListeners(),
+				},
+			},
+			expect: false,
+		},
+		{
+			name: "no-listeners",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "test",
+				},
+			},
+			expect: true,
+		},
+		{
+			name: "no-listener-ports",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "test",
+					Listeners: []*ProxyListener{
+						{
+							Ports: []ListenerPort{},
+						},
+					},
+				},
+			},
+			expect: false,
+		},
+		{
+			name: "no-listener-port-name",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "test",
+					Listeners: []*ProxyListener{
+						{
+							Ports: []ListenerPort{
+								{
+									ServicePort:   int32(80),
+									ContainerPort: int32(8080),
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+		},
+		{
+			name: "no-listener-service-port-number",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "test",
+					Listeners: []*ProxyListener{
+						{
+							Ports: []ListenerPort{
+								{
+									Name:          "http",
+									ContainerPort: int32(8080),
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+		},
+		{
+			name: "no-listener-container-port-number",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "test",
+					Listeners: []*ProxyListener{
+						{
+							Ports: []ListenerPort{
+								{
+									Name:        "http",
+									ServicePort: int32(80),
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.infra.Validate()
+			if !tc.expect {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestNewInfra(t *testing.T) {
+	testCases := []struct {
+		name     string
+		expected *Infra
+	}{
+		{
+			name: "default infra",
+			expected: &Infra{
+				Proxy: NewProxyInfra(),
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			actual := NewInfra()
+			require.Equal(t, tc.expected, actual)
+		})
+	}
+}
+
+func TestNewProxyInfra(t *testing.T) {
+	testCases := []struct {
+		name     string
+		expected *ProxyInfra
+	}{
+		{
+			name: "default infra",
+			expected: &ProxyInfra{
+				Metadata: NewInfraMetadata(),
+				Name:     DefaultProxyName,
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			actual := NewProxyInfra()
+			require.Equal(t, tc.expected, actual)
+		})
+	}
+}
+
+func TestObjectName(t *testing.T) {
+	defaultInfra := NewInfra()
+
+	testCases := []struct {
+		name     string
+		infra    *Infra
+		expected string
+	}{
+		{
+			name:     "default infra",
+			infra:    defaultInfra,
+			expected: "envoy-default",
+		},
+		{
+			name: "defined infra",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "foo",
+				},
+			},
+			expected: "envoy-foo",
+		},
+		{
+			name: "unspecified infra name",
+			infra: &Infra{
+				Proxy: &ProxyInfra{},
+			},
+			expected: "envoy-default",
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			actual := tc.infra.Proxy.ObjectName()
+			require.Equal(t, tc.expected, actual)
+		})
+	}
+}
+
+func TestEqualInfra(t *testing.T) {
+	tests := []struct {
+		desc  string
+		a     *ProxyInfra
+		b     *ProxyInfra
+		equal bool
+	}{
+		{
+			desc: "out of order proxy listeners are equal",
+			a: &ProxyInfra{
+				Listeners: []*ProxyListener{
+					{Name: "listener-1"},
+					{Name: "listener-2"},
+				},
+			},
+			b: &ProxyInfra{
+				Listeners: []*ProxyListener{
+					{Name: "listener-2"},
+					{Name: "listener-1"},
+				},
+			},
+			equal: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.desc, func(t *testing.T) {
+			require.Equal(t, tc.equal, cmp.Equal(tc.a, tc.b))
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/ir/protocol.go b/adapter/internal/operator/gateway-api/ir/protocol.go
new file mode 100644
index 000000000..8847ab54a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/protocol.go
@@ -0,0 +1,44 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package ir
+
+type AppProtocol string
+
+const (
+	// GRPC declares that the port carries gRPC traffic.
+	GRPC AppProtocol = "GRPC"
+	// GRPCWeb declares that the port carries gRPC traffic.
+	GRPCWeb AppProtocol = "GRPC-Web"
+	// HTTP declares that the port carries HTTP/1.1 traffic.
+	// Note that HTTP/1.0 or earlier may not be supported by the proxy.
+	HTTP AppProtocol = "HTTP"
+	// HTTP2 declares that the port carries HTTP/2 traffic.
+	HTTP2 AppProtocol = "HTTP2"
+	// HTTPS declares that the port carries HTTPS traffic.
+	HTTPS AppProtocol = "HTTPS"
+	// TCP declares the port uses TCP.
+	// This is the default protocol for a service port.
+	TCP AppProtocol = "TCP"
+	// UDP declares that the port uses UDP.
+	UDP AppProtocol = "UDP"
+)
diff --git a/adapter/internal/operator/gateway-api/ir/xds.go b/adapter/internal/operator/gateway-api/ir/xds.go
new file mode 100644
index 000000000..f9cc35559
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/xds.go
@@ -0,0 +1,1749 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package ir
+
+import (
+	"cmp"
+	"errors"
+	"net/http"
+	"net/netip"
+	"reflect"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/types"
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	"golang.org/x/exp/slices"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"sigs.k8s.io/yaml"
+)
+
+var (
+	ErrListenerNameEmpty                       = errors.New("field Name must be specified")
+	ErrListenerAddressInvalid                  = errors.New("field Address must be a valid IP address")
+	ErrListenerPortInvalid                     = errors.New("field Port specified is invalid")
+	ErrHTTPListenerHostnamesEmpty              = errors.New("field Hostnames must be specified with at least a single hostname entry")
+	ErrTCPListenerSNIsEmpty                    = errors.New("field SNIs must be specified with at least a single server name entry")
+	ErrTLSServerCertEmpty                      = errors.New("field ServerCertificate must be specified")
+	ErrTLSPrivateKey                           = errors.New("field PrivateKey must be specified")
+	ErrHTTPRouteNameEmpty                      = errors.New("field Name must be specified")
+	ErrHTTPRouteHostnameEmpty                  = errors.New("field Hostname must be specified")
+	ErrDestinationNameEmpty                    = errors.New("field Name must be specified")
+	ErrDestEndpointHostInvalid                 = errors.New("field Address must be a valid IP or FQDN address")
+	ErrDestEndpointPortInvalid                 = errors.New("field Port specified is invalid")
+	ErrStringMatchConditionInvalid             = errors.New("only one of the Exact, Prefix, SafeRegex or Distinct fields must be set")
+	ErrStringMatchNameIsEmpty                  = errors.New("field Name must be specified")
+	ErrDirectResponseStatusInvalid             = errors.New("only HTTP status codes 100 - 599 are supported for DirectResponse")
+	ErrRedirectUnsupportedStatus               = errors.New("only HTTP status codes 301 and 302 are supported for redirect filters")
+	ErrRedirectUnsupportedScheme               = errors.New("only http and https are supported for the scheme in redirect filters")
+	ErrHTTPPathModifierDoubleReplace           = errors.New("redirect filter cannot have a path modifier that supplies both fullPathReplace and prefixMatchReplace")
+	ErrHTTPPathModifierNoReplace               = errors.New("redirect filter cannot have a path modifier that does not supply either fullPathReplace or prefixMatchReplace")
+	ErrAddHeaderEmptyName                      = errors.New("header modifier filter cannot configure a header without a name to be added")
+	ErrAddHeaderDuplicate                      = errors.New("header modifier filter attempts to add the same header more than once (case insensitive)")
+	ErrRemoveHeaderDuplicate                   = errors.New("header modifier filter attempts to remove the same header more than once (case insensitive)")
+	ErrLoadBalancerInvalid                     = errors.New("loadBalancer setting is invalid, only one setting can be set")
+	ErrHealthCheckTimeoutInvalid               = errors.New("field HealthCheck.Timeout must be specified")
+	ErrHealthCheckIntervalInvalid              = errors.New("field HealthCheck.Interval must be specified")
+	ErrHealthCheckUnhealthyThresholdInvalid    = errors.New("field HealthCheck.UnhealthyThreshold should be greater than 0")
+	ErrHealthCheckHealthyThresholdInvalid      = errors.New("field HealthCheck.HealthyThreshold should be greater than 0")
+	ErrHealthCheckerInvalid                    = errors.New("health checker setting is invalid, only one health checker can be set")
+	ErrHCHTTPHostInvalid                       = errors.New("field HTTPHealthChecker.Host should be specified")
+	ErrHCHTTPPathInvalid                       = errors.New("field HTTPHealthChecker.Path should be specified")
+	ErrHCHTTPMethodInvalid                     = errors.New("only one of the GET, HEAD, POST, DELETE, OPTIONS, TRACE, PATCH of HTTPHealthChecker.Method could be set")
+	ErrHCHTTPExpectedStatusesInvalid           = errors.New("field HTTPHealthChecker.ExpectedStatuses should be specified")
+	ErrHealthCheckPayloadInvalid               = errors.New("one of Text, Binary fields must be set in payload")
+	ErrHTTPStatusInvalid                       = errors.New("HTTPStatus should be in [200,600)")
+	ErrOutlierDetectionBaseEjectionTimeInvalid = errors.New("field OutlierDetection.BaseEjectionTime must be specified")
+	ErrOutlierDetectionIntervalInvalid         = errors.New("field OutlierDetection.Interval must be specified")
+
+	redacted = []byte("[redacted]")
+)
+
+// Xds holds the intermediate representation of a Gateway and is
+// used by the xDS Translator to convert it into xDS resources.
+// +k8s:deepcopy-gen=true
+type Xds struct {
+	// AccessLog configuration for the gateway.
+	AccessLog *AccessLog `json:"accessLog,omitempty" yaml:"accessLog,omitempty"`
+	// Tracing configuration for the gateway.
+	Tracing *Tracing `json:"tracing,omitempty" yaml:"tracing,omitempty"`
+	// Metrics configuration for the gateway.
+	Metrics *Metrics `json:"metrics,omitempty" yaml:"metrics,omitempty"`
+	// HTTP listeners exposed by the gateway.
+	HTTP []*HTTPListener `json:"http,omitempty" yaml:"http,omitempty"`
+	// TCP Listeners exposed by the gateway.
+	TCP []*TCPListener `json:"tcp,omitempty" yaml:"tcp,omitempty"`
+	// UDP Listeners exposed by the gateway.
+	UDP []*UDPListener `json:"udp,omitempty" yaml:"udp,omitempty"`
+	// EnvoyPatchPolicies is the intermediate representation of the EnvoyPatchPolicy resource
+	// EnvoyPatchPolicies []*EnvoyPatchPolicy `json:"envoyPatchPolicies,omitempty" yaml:"envoyPatchPolicies,omitempty"`
+}
+
+// Equal implements the Comparable interface used by watchable.DeepEqual to skip unnecessary updates.
+func (x *Xds) Equal(y *Xds) bool {
+	// Deep copy to avoid modifying the original ordering.
+	x = x.DeepCopy()
+	x.sort()
+	y = y.DeepCopy()
+	y.sort()
+	return reflect.DeepEqual(x, y)
+}
+
+// sort ensures the listeners are in a consistent order.
+func (x *Xds) sort() {
+	slices.SortFunc(x.HTTP, func(l1, l2 *HTTPListener) int {
+		return cmp.Compare(l1.Name, l2.Name)
+	})
+	for _, l := range x.HTTP {
+		slices.SortFunc(l.Routes, func(r1, r2 *HTTPRoute) int {
+			return cmp.Compare(r1.Name, r2.Name)
+		})
+	}
+	slices.SortFunc(x.TCP, func(l1, l2 *TCPListener) int {
+		return cmp.Compare(l1.Name, l2.Name)
+	})
+	slices.SortFunc(x.UDP, func(l1, l2 *UDPListener) int {
+		return cmp.Compare(l1.Name, l2.Name)
+	})
+}
+
+// Validate the fields within the Xds structure.
+func (x Xds) Validate() error {
+	var errs error
+	for _, http := range x.HTTP {
+		if err := http.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	for _, tcp := range x.TCP {
+		if err := tcp.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	for _, udp := range x.UDP {
+		if err := udp.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+func (x Xds) GetHTTPListener(name string) *HTTPListener {
+	for _, listener := range x.HTTP {
+		if listener.Name == name {
+			return listener
+		}
+	}
+	return nil
+}
+
+func (x Xds) GetTCPListener(name string) *TCPListener {
+	for _, listener := range x.TCP {
+		if listener.Name == name {
+			return listener
+		}
+	}
+	return nil
+}
+
+func (x Xds) GetUDPListener(name string) *UDPListener {
+	for _, listener := range x.UDP {
+		if listener.Name == name {
+			return listener
+		}
+	}
+	return nil
+}
+
+func (x Xds) YAMLString() string {
+	y, _ := yaml.Marshal(x.Printable())
+	return string(y)
+}
+
+// Printable returns a deep copy of the resource that can be safely logged.
+func (x Xds) Printable() *Xds {
+	out := x.DeepCopy()
+	for _, listener := range out.HTTP {
+		// Omit field
+		if listener.TLS != nil {
+			for i := range listener.TLS.Certificates {
+				listener.TLS.Certificates[i].PrivateKey = redacted
+			}
+		}
+
+		for _, route := range listener.Routes {
+			// Omit field
+			if route.OIDC != nil {
+				route.OIDC.ClientSecret = redacted
+				route.OIDC.HMACSecret = redacted
+			}
+			if route.BasicAuth != nil {
+				route.BasicAuth.Users = redacted
+			}
+		}
+	}
+	return out
+}
+
+// HTTPListener holds the listener configuration.
+// +k8s:deepcopy-gen=true
+type HTTPListener struct {
+	// Name of the HttpListener
+	Name string `json:"name" yaml:"name"`
+	// Address that the listener should listen on.
+	Address string `json:"address" yaml:"address"`
+	// Port on which the service can be expected to be accessed by clients.
+	Port uint32 `json:"port" yaml:"port"`
+	// Hostnames (Host/Authority header value) with which the service can be expected to be accessed by clients.
+	// This field is required. Wildcard hosts are supported in the suffix or prefix form.
+	// Refer to https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-virtualhost
+	// for more info.
+	Hostnames []string `json:"hostnames" yaml:"hostnames"`
+	// Tls configuration. If omitted, the gateway will expose a plain text HTTP server.
+	TLS *TLSConfig `json:"tls,omitempty" yaml:"tls,omitempty"`
+	// Routes associated with HTTP traffic to the service.
+	Routes []*HTTPRoute `json:"routes,omitempty" yaml:"routes,omitempty"`
+	// IsHTTP2 is set if the listener is configured to serve HTTP2 traffic,
+	// grpc-web and grpc-stats are also enabled if this is set.
+	IsHTTP2 bool `json:"isHTTP2" yaml:"isHTTP2"`
+	// TCPKeepalive configuration for the listener
+	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty" yaml:"tcpKeepalive,omitempty"`
+	// Headers configures special header management for the listener
+	Headers *HeaderSettings `json:"headers,omitempty" yaml:"headers,omitempty"`
+	// EnableProxyProtocol enables the listener to interpret proxy protocol header
+	EnableProxyProtocol bool `json:"enableProxyProtocol,omitempty" yaml:"enableProxyProtocol,omitempty"`
+	// ClientIPDetection controls how the original client IP address is determined for requests.
+	// ClientIPDetection *ClientIPDetectionSettings `json:"clientIPDetection,omitempty" yaml:"clientIPDetection,omitempty"`
+	// HTTP3 provides HTTP/3 configuration on the listener.
+	// +optional
+	HTTP3 *HTTP3Settings `json:"http3,omitempty"`
+	// Path contains settings for path URI manipulations
+	Path PathSettings `json:"path,omitempty"`
+	// HTTP1 provides HTTP/1 configuration on the listener
+	// +optional
+	HTTP1 *HTTP1Settings `json:"http1,omitempty" yaml:"http1,omitempty"`
+	// ClientTimeout sets the timeout configuration for downstream connections
+	Timeout *ClientTimeout `json:"timeout,omitempty" yaml:"clientTimeout,omitempty"`
+}
+
+// Validate the fields within the HTTPListener structure
+func (h HTTPListener) Validate() error {
+	var errs error
+	if h.Name == "" {
+		errs = errors.Join(errs, ErrListenerNameEmpty)
+	}
+	if _, err := netip.ParseAddr(h.Address); err != nil {
+		errs = errors.Join(errs, ErrListenerAddressInvalid)
+	}
+	if h.Port == 0 {
+		errs = errors.Join(errs, ErrListenerPortInvalid)
+	}
+	if len(h.Hostnames) == 0 {
+		errs = errors.Join(errs, ErrHTTPListenerHostnamesEmpty)
+	}
+	if h.TLS != nil {
+		if err := h.TLS.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	for _, route := range h.Routes {
+		if err := route.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+type TLSVersion types.TLSVersion
+
+const (
+	// TLSAuto allows Envoy to choose the optimal TLS Version
+	TLSAuto = TLSVersion(types.TLSAuto)
+	// TLSv10 specifies TLS version 1.0
+	TLSv10 = TLSVersion(types.TLSv10)
+	// TLSv11 specifies TLS version 1.1
+	TLSv11 = TLSVersion(types.TLSv11)
+	// TLSv12 specifies TLS version 1.2
+	TLSv12 = TLSVersion(types.TLSv12)
+	// TLSv13 specifies TLS version 1.3
+	TLSv13 = TLSVersion(types.TLSv13)
+)
+
+// TLSConfig holds the configuration for downstream TLS context.
+// +k8s:deepcopy-gen=true
+type TLSConfig struct {
+	// Certificates contains the set of certificates associated with this listener
+	Certificates []TLSCertificate `json:"certificates,omitempty" yaml:"certificates,omitempty"`
+	// CACertificate to verify the client
+	CACertificate *TLSCACertificate `json:"caCertificate,omitempty" yaml:"caCertificate,omitempty"`
+	// MinVersion defines the minimal version of the TLS protocol supported by this listener.
+	MinVersion *TLSVersion `json:"minVersion,omitempty" yaml:"version,omitempty"`
+	// MaxVersion defines the maximal version of the TLS protocol supported by this listener.
+	MaxVersion *TLSVersion `json:"maxVersion,omitempty" yaml:"version,omitempty"`
+	// CipherSuites supported by this listener
+	Ciphers []string `json:"ciphers,omitempty" yaml:"ciphers,omitempty"`
+	// EDCHCurves supported by this listener
+	ECDHCurves []string `json:"ecdhCurves,omitempty" yaml:"ecdhCurves,omitempty"`
+	// SignatureAlgorithms supported by this listener
+	SignatureAlgorithms []string `json:"signatureAlgorithms,omitempty" yaml:"signatureAlgorithms,omitempty"`
+	// ALPNProtocols exposed by this listener
+	ALPNProtocols []string `json:"alpnProtocols,omitempty" yaml:"alpnProtocols,omitempty"`
+}
+
+// TLSCertificate holds a single certificate's details
+// +k8s:deepcopy-gen=true
+type TLSCertificate struct {
+	// Name of the Secret object.
+	Name string `json:"name" yaml:"name"`
+	// ServerCertificate of the server.
+	ServerCertificate []byte `json:"serverCertificate,omitempty" yaml:"serverCertificate,omitempty"`
+	// PrivateKey for the server.
+	PrivateKey []byte `json:"privateKey,omitempty" yaml:"privateKey,omitempty"`
+}
+
+// TLSCACertificate holds CA Certificate to validate clients
+// +k8s:deepcopy-gen=true
+type TLSCACertificate struct {
+	// Name of the Secret object.
+	Name string `json:"name,omitempty" yaml:"name,omitempty"`
+	// Certificate content.
+	Certificate []byte `json:"certificate,omitempty" yaml:"certificate,omitempty"`
+}
+
+func (t TLSCertificate) Validate() error {
+	var errs error
+	if len(t.ServerCertificate) == 0 {
+		errs = errors.Join(errs, ErrTLSServerCertEmpty)
+	}
+	if len(t.PrivateKey) == 0 {
+		errs = errors.Join(errs, ErrTLSPrivateKey)
+	}
+	return errs
+}
+
+// Validate the fields within the TLSListenerConfig structure
+func (t TLSConfig) Validate() error {
+	var errs error
+	for _, cert := range t.Certificates {
+		if err := cert.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	// Correct values for cipher suites, ECDH curves, and signature algorithms are
+	// dependent on the version of EnvoyProxy being used - different values are valid
+	// depending if Envoy was compiled against BoringSSL or OpenSSL, or even the exact version
+	// of each of these libraries.
+	// Validation for TLS versions was done with CEL
+	return errs
+}
+
+// PathSettings holds configuration for path URI manipulations
+// +k8s:deepcopy-gen=true
+type PathSettings struct {
+	MergeSlashes bool `json:"mergeSlashes" yaml:"mergeSlashes"`
+	// EscapedSlashesAction PathEscapedSlashAction `json:"escapedSlashesAction" yaml:"escapedSlashesAction"`
+}
+
+// ClientIPDetectionSettings provides configuration for determining the original client IP address for requests.
+// +k8s:deepcopy-gen=true
+// type ClientIPDetectionSettings egv1a1.ClientIPDetectionSettings
+
+// BackendWeights stores the weights of valid and invalid backends for the route so that 500 error responses can be returned in the same proportions
+type BackendWeights struct {
+	Valid   uint32 `json:"valid" yaml:"valid"`
+	Invalid uint32 `json:"invalid" yaml:"invalid"`
+}
+
+// HTTP1Settings provides HTTP/1 configuration on the listener.
+// +k8s:deepcopy-gen=true
+type HTTP1Settings struct {
+	EnableTrailers     bool            `json:"enableTrailers,omitempty" yaml:"enableTrailers,omitempty"`
+	PreserveHeaderCase bool            `json:"preserveHeaderCase,omitempty" yaml:"preserveHeaderCase,omitempty"`
+	HTTP10             *HTTP10Settings `json:"http10,omitempty" yaml:"http10,omitempty"`
+}
+
+// HTTP10Settings provides HTTP/1.0 configuration on the listener.
+// +k8s:deepcopy-gen=true
+type HTTP10Settings struct {
+	// defaultHost is set to the default host that should be injected for HTTP10. If the hostname shouldn't
+	// be set, then defaultHost will be nil
+	DefaultHost *string `json:"defaultHost,omitempty" yaml:"defaultHost,omitempty"`
+}
+
+// HeaderSettings provides configuration related to header processing on the listener.
+// +k8s:deepcopy-gen=true
+type HeaderSettings struct {
+	// EnableEnvoyHeaders controls if "x-envoy-" headers are added by the HTTP Router filter.
+	// The default is to suppress these headers.
+	// Refer to https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/router/v3/router.proto#extensions-filters-http-router-v3-router
+	EnableEnvoyHeaders bool `json:"enableEnvoyHeaders,omitempty" yaml:"enableEnvoyHeaders,omitempty"`
+}
+
+// ClientTimeout sets the timeout configuration for downstream connections
+// +k8s:deepcopy-gen=true
+type ClientTimeout struct {
+	// Timeout settings for HTTP.
+	HTTP *HTTPClientTimeout `json:"http,omitempty" yaml:"http,omitempty"`
+}
+
+// HTTPClientTimeout set the configuration for client HTTP.
+// +k8s:deepcopy-gen=true
+type HTTPClientTimeout struct {
+	// The duration envoy waits for the complete request reception. This timer starts upon request
+	// initiation and stops when either the last byte of the request is sent upstream or when the response begins.
+	RequestReceivedTimeout *metav1.Duration `json:"requestReceivedTimeout,omitempty" yaml:"requestReceivedTimeout,omitempty"`
+}
+
+// HTTPRoute holds the route information associated with the HTTP Route
+// +k8s:deepcopy-gen=true
+type HTTPRoute struct {
+	// Name of the HTTPRoute
+	Name string `json:"name" yaml:"name"`
+	// Hostname that the route matches against
+	Hostname string `json:"hostname" yaml:"hostname,omitempty"`
+	// IsHTTP2 is set if the route is configured to serve HTTP2 traffic
+	IsHTTP2 bool `json:"isHTTP2" yaml:"isHTTP2"`
+	// PathMatch defines the match conditions on the path.
+	PathMatch *StringMatch `json:"pathMatch,omitempty" yaml:"pathMatch,omitempty"`
+	// HeaderMatches define the match conditions on the request headers for this route.
+	HeaderMatches []*StringMatch `json:"headerMatches,omitempty" yaml:"headerMatches,omitempty"`
+	// QueryParamMatches define the match conditions on the query parameters.
+	QueryParamMatches []*StringMatch `json:"queryParamMatches,omitempty" yaml:"queryParamMatches,omitempty"`
+	// DestinationWeights stores the weights of valid and invalid backends for the route so that 500 error responses can be returned in the same proportions
+	BackendWeights BackendWeights `json:"backendWeights" yaml:"backendWeights"`
+	// AddRequestHeaders defines header/value sets to be added to the headers of requests.
+	AddRequestHeaders []AddHeader `json:"addRequestHeaders,omitempty" yaml:"addRequestHeaders,omitempty"`
+	// RemoveRequestHeaders defines a list of headers to be removed from requests.
+	RemoveRequestHeaders []string `json:"removeRequestHeaders,omitempty" yaml:"removeRequestHeaders,omitempty"`
+	// AddResponseHeaders defines header/value sets to be added to the headers of response.
+	AddResponseHeaders []AddHeader `json:"addResponseHeaders,omitempty" yaml:"addResponseHeaders,omitempty"`
+	// RemoveResponseHeaders defines a list of headers to be removed from response.
+	RemoveResponseHeaders []string `json:"removeResponseHeaders,omitempty" yaml:"removeResponseHeaders,omitempty"`
+	// Direct responses to be returned for this route. Takes precedence over Destinations and Redirect.
+	DirectResponse *DirectResponse `json:"directResponse,omitempty" yaml:"directResponse,omitempty"`
+	// Redirections to be returned for this route. Takes precedence over Destinations.
+	Redirect *Redirect `json:"redirect,omitempty" yaml:"redirect,omitempty"`
+	// Destination that requests to this HTTPRoute will be mirrored to
+	Mirrors []*RouteDestination `json:"mirrors,omitempty" yaml:"mirrors,omitempty"`
+	// Destination associated with this matched route.
+	Destination *RouteDestination `json:"destination,omitempty" yaml:"destination,omitempty"`
+	// Rewrite to be changed for this route.
+	URLRewrite *URLRewrite `json:"urlRewrite,omitempty" yaml:"urlRewrite,omitempty"`
+	// RateLimit defines the more specific match conditions as well as limits for ratelimiting
+	// the requests on this route.
+	RateLimit *RateLimit `json:"rateLimit,omitempty" yaml:"rateLimit,omitempty"`
+	// load balancer policy to use when routing to the backend endpoints.
+	LoadBalancer *LoadBalancer `json:"loadBalancer,omitempty" yaml:"loadBalancer,omitempty"`
+	// CORS policy for the route.
+	CORS *CORS `json:"cors,omitempty" yaml:"cors,omitempty"`
+	// JWT defines the schema for authenticating HTTP requests using JSON Web Tokens (JWT).
+	// JWT *JWT `json:"jwt,omitempty" yaml:"jwt,omitempty"`
+	// OIDC defines the schema for authenticating HTTP requests using OpenID Connect (OIDC).
+	OIDC *OIDC `json:"oidc,omitempty" yaml:"oidc,omitempty"`
+	// Proxy Protocol Settings
+	ProxyProtocol *ProxyProtocol `json:"proxyProtocol,omitempty" yaml:"proxyProtocol,omitempty"`
+	// BasicAuth defines the schema for the HTTP Basic Authentication.
+	BasicAuth *BasicAuth `json:"basicAuth,omitempty" yaml:"basicAuth,omitempty"`
+	// ExtAuth defines the schema for the external authorization.
+	ExtAuth *ExtAuth `json:"extAuth,omitempty" yaml:"extAuth,omitempty"`
+	// HealthCheck defines the configuration for health checking on the upstream.
+	HealthCheck *HealthCheck `json:"healthCheck,omitempty" yaml:"healthCheck,omitempty"`
+	// FaultInjection defines the schema for injecting faults into HTTP requests.
+	FaultInjection *FaultInjection `json:"faultInjection,omitempty" yaml:"faultInjection,omitempty"`
+	// ExtensionRefs holds unstructured resources that were introduced by an extension and used on the HTTPRoute as extensionRef filters
+	ExtensionRefs []*UnstructuredRef `json:"extensionRefs,omitempty" yaml:"extensionRefs,omitempty"`
+	// Circuit Breaker Settings
+	CircuitBreaker *CircuitBreaker `json:"circuitBreaker,omitempty" yaml:"circuitBreaker,omitempty"`
+	// Request and connection timeout settings
+	Timeout *Timeout `json:"timeout,omitempty" yaml:"timeout,omitempty"`
+	// TcpKeepalive settings associated with the upstream client connection.
+	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty" yaml:"tcpKeepalive,omitempty"`
+	// Retry settings
+	Retry *Retry `json:"retry,omitempty" yaml:"retry,omitempty"`
+}
+
+// UnstructuredRef holds unstructured data for an arbitrary k8s resource introduced by an extension
+// Envoy Gateway does not need to know about the resource types in order to store and pass the data for these objects
+// to an extension.
+//
+// +k8s:deepcopy-gen=true
+type UnstructuredRef struct {
+	Object *unstructured.Unstructured `json:"object,omitempty" yaml:"object,omitempty"`
+}
+
+// CORS holds the Cross-Origin Resource Sharing (CORS) policy for the route.
+//
+// +k8s:deepcopy-gen=true
+type CORS struct {
+	// AllowOrigins defines the origins that are allowed to make requests.
+	AllowOrigins []*StringMatch `json:"allowOrigins,omitempty" yaml:"allowOrigins,omitempty"`
+	// AllowMethods defines the methods that are allowed to make requests.
+	AllowMethods []string `json:"allowMethods,omitempty" yaml:"allowMethods,omitempty"`
+	// AllowHeaders defines the headers that are allowed to be sent with requests.
+	AllowHeaders []string `json:"allowHeaders,omitempty" yaml:"allowHeaders,omitempty"`
+	// ExposeHeaders defines the headers that can be exposed in the responses.
+	ExposeHeaders []string `json:"exposeHeaders,omitempty" yaml:"exposeHeaders,omitempty"`
+	// MaxAge defines how long the results of a preflight request can be cached.
+	MaxAge *metav1.Duration `json:"maxAge,omitempty" yaml:"maxAge,omitempty"`
+	// AllowCredentials indicates whether a request can include user credentials.
+	AllowCredentials bool `json:"allowCredentials,omitempty" yaml:"allowCredentials,omitempty"`
+}
+
+// // JWT defines the schema for authenticating HTTP requests using
+// // JSON Web Tokens (JWT).
+// //
+// // +k8s:deepcopy-gen=true
+// type JWT struct {
+// 	// Providers defines a list of JSON Web Token (JWT) authentication providers.
+// 	Providers []egv1a1.JWTProvider `json:"providers,omitempty" yaml:"providers,omitempty"`
+// }
+
+// OIDC defines the schema for authenticating HTTP requests using
+// OpenID Connect (OIDC).
+//
+// +k8s:deepcopy-gen=true
+type OIDC struct {
+	// The OIDC Provider configuration.
+	Provider OIDCProvider `json:"provider" yaml:"provider"`
+
+	// The OIDC client ID to be used in the
+	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
+	ClientID string `json:"clientID" yaml:"clientID"`
+
+	// The OIDC client secret to be used in the
+	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
+	//
+	// This is an Opaque secret. The client secret should be stored in the key "client-secret".
+	ClientSecret []byte `json:"clientSecret,omitempty" yaml:"clientSecret,omitempty"`
+
+	// HMACSecret is the secret used to sign the HMAC of the OAuth2 filter cookies.
+	HMACSecret []byte `json:"hmacSecret,omitempty" yaml:"hmacSecret,omitempty"`
+
+	// The OIDC scopes to be used in the
+	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
+	Scopes []string `json:"scopes,omitempty" yaml:"scopes,omitempty"`
+
+	// The redirect URL to be used in the OIDC
+	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
+	RedirectURL string `json:"redirectURL,omitempty"`
+
+	// The path part of the redirect URL
+	RedirectPath string `json:"redirectPath,omitempty"`
+
+	// The path to log a user out, clearing their credential cookies.
+	LogoutPath string `json:"logoutPath,omitempty"`
+
+	// CookieSuffix will be added to the name of the cookies set by the oauth filter.
+	// Adding a suffix avoids multiple oauth filters from overwriting each other's cookies.
+	// These cookies are set by the oauth filter, including: BearerToken,
+	// OauthHMAC, OauthExpires, IdToken, and RefreshToken.
+	CookieSuffix string `json:"cookieSuffix,omitempty"`
+}
+
+type OIDCProvider struct {
+	// The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).
+	AuthorizationEndpoint string `json:"authorizationEndpoint,omitempty"`
+
+	// The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).
+	TokenEndpoint string `json:"tokenEndpoint,omitempty"`
+}
+
+// BasicAuth defines the schema for the HTTP Basic Authentication.
+//
+// +k8s:deepcopy-gen=true
+type BasicAuth struct {
+	// The username-password pairs in htpasswd format.
+	Users []byte `json:"users,omitempty" yaml:"users,omitempty"`
+}
+
+// ExtAuth defines the schema for the external authorization.
+//
+// +k8s:deepcopy-gen=true
+type ExtAuth struct {
+	// GRPC defines the gRPC External Authorization service.
+	// Only one of GRPCService or HTTPService may be specified.
+	GRPC *GRPCExtAuthService `json:"grpc,omitempty"`
+
+	// HTTP defines the HTTP External Authorization service.
+	// Only one of GRPCService or HTTPService may be specified.
+	HTTP *HTTPExtAuthService `json:"http,omitempty"`
+
+	// HeadersToExtAuth defines the client request headers that will be included
+	// in the request to the external authorization service.
+	// Note: If not specified, the default behavior for gRPC and HTTP external
+	// authorization services is different due to backward compatibility reasons.
+	// All headers will be included in the check request to a gRPC authorization server.
+	// Only the following headers will be included in the check request to an HTTP
+	// authorization server: Host, Method, Path, Content-Length, and Authorization.
+	// And these headers will always be included to the check request to an HTTP
+	// authorization server by default, no matter whether they are specified
+	// in HeadersToExtAuth or not.
+	// +optional
+	HeadersToExtAuth []string `json:"headersToExtAuth,omitempty"`
+}
+
+// HTTPExtAuthService defines the HTTP External Authorization service
+// +k8s:deepcopy-gen=true
+type HTTPExtAuthService struct {
+	// Destination defines the destination for the HTTP External Authorization service.
+	Destination RouteDestination `json:"destination"`
+
+	// Authority is the hostname:port of the HTTP External Authorization service.
+	Authority string `json:"authority"`
+
+	// Path is the path of the HTTP External Authorization service.
+	// If path is not empty, the authorization request will be sent to that path,
+	// or else the authorization request will be sent to the root path.
+	Path string `json:"path"`
+
+	// HeadersToBackend are the authorization response headers that will be added
+	// to the original client request before sending it to the backend server.
+	// Note that coexisting headers will be overridden.
+	// If not specified, no authorization response headers will be added to the
+	// original client request.
+	// +optional
+	HeadersToBackend []string `json:"headersToBackend,omitempty"`
+}
+
+// GRPCExtAuthService defines the gRPC External Authorization service
+// The authorization request message is defined in
+// https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+// +k8s:deepcopy-gen=true
+type GRPCExtAuthService struct {
+	// Destination defines the destination for the gRPC External Authorization service.
+	Destination RouteDestination `json:"destination"`
+
+	// Authority is the hostname:port of the gRPC External Authorization service.
+	Authority string `json:"authority"`
+}
+
+// FaultInjection defines the schema for injecting faults into requests.
+//
+// +k8s:deepcopy-gen=true
+type FaultInjection struct {
+	// Delay defines the fault injection delay.
+	Delay *FaultInjectionDelay `json:"delay,omitempty" yaml:"delay,omitempty"`
+	// Abort defines the fault injection abort.
+	Abort *FaultInjectionAbort `json:"abort,omitempty" yaml:"abort,omitempty"`
+}
+
+// FaultInjectionDelay defines the schema for injecting delay into requests.
+//
+// +k8s:deepcopy-gen=true
+type FaultInjectionDelay struct {
+	// FixedDelay defines the fixed delay duration.
+	FixedDelay *metav1.Duration `json:"fixedDelay,omitempty" yaml:"fixedDelay,omitempty"`
+	// Percentage defines the percentage of requests to be delayed.
+	Percentage *float32 `json:"percentage,omitempty" yaml:"percentage,omitempty"`
+}
+
+// FaultInjectionAbort defines the schema for injecting abort into requests.
+//
+// +k8s:deepcopy-gen=true
+type FaultInjectionAbort struct {
+	// HTTPStatus defines the HTTP status code to be returned.
+	HTTPStatus *int32 `json:"httpStatus,omitempty" yaml:"httpStatus,omitempty"`
+	// GrpcStatus defines the gRPC status code to be returned.
+	GrpcStatus *int32 `json:"grpcStatus,omitempty" yaml:"grpcStatus,omitempty"`
+	// Percentage defines the percentage of requests to be aborted.
+	Percentage *float32 `json:"percentage,omitempty" yaml:"percentage,omitempty"`
+}
+
+// Validate the fields within the HTTPRoute structure
+func (h HTTPRoute) Validate() error {
+	var errs error
+	if h.Name == "" {
+		errs = errors.Join(errs, ErrHTTPRouteNameEmpty)
+	}
+	if h.Hostname == "" {
+		errs = errors.Join(errs, ErrHTTPRouteHostnameEmpty)
+	}
+	if h.PathMatch != nil {
+		if err := h.PathMatch.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	for _, hMatch := range h.HeaderMatches {
+		if err := hMatch.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	for _, qMatch := range h.QueryParamMatches {
+		if err := qMatch.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if h.Destination != nil {
+		if err := h.Destination.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if h.Redirect != nil {
+		if err := h.Redirect.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if h.DirectResponse != nil {
+		if err := h.DirectResponse.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if h.URLRewrite != nil {
+		if err := h.URLRewrite.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if h.Mirrors != nil {
+		for _, mirror := range h.Mirrors {
+			if err := mirror.Validate(); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+	if len(h.AddRequestHeaders) > 0 {
+		occurred := sets.NewString()
+		for _, header := range h.AddRequestHeaders {
+			if err := header.Validate(); err != nil {
+				errs = errors.Join(errs, err)
+			}
+			if occurred.Has(header.Name) {
+				errs = errors.Join(errs, ErrAddHeaderDuplicate)
+				break
+			}
+			occurred.Insert(header.Name)
+		}
+	}
+	if len(h.RemoveRequestHeaders) > 0 {
+		occurred := sets.NewString()
+		for _, header := range h.RemoveRequestHeaders {
+			if occurred.Has(header) {
+				errs = errors.Join(errs, ErrRemoveHeaderDuplicate)
+				break
+			}
+			occurred.Insert(header)
+		}
+	}
+	if len(h.AddResponseHeaders) > 0 {
+		occurred := sets.NewString()
+		for _, header := range h.AddResponseHeaders {
+			if err := header.Validate(); err != nil {
+				errs = errors.Join(errs, err)
+			}
+			if occurred.Has(header.Name) {
+				errs = errors.Join(errs, ErrAddHeaderDuplicate)
+				break
+			}
+			occurred.Insert(header.Name)
+		}
+	}
+	if len(h.RemoveResponseHeaders) > 0 {
+		occurred := sets.NewString()
+		for _, header := range h.RemoveResponseHeaders {
+			if occurred.Has(header) {
+				errs = errors.Join(errs, ErrRemoveHeaderDuplicate)
+				break
+			}
+			occurred.Insert(header)
+		}
+	}
+	if h.LoadBalancer != nil {
+		if err := h.LoadBalancer.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	// if h.JWT != nil {
+	// 	if err := h.JWT.validate(); err != nil {
+	// 		errs = errors.Join(errs, err)
+	// 	}
+	// }
+	if h.HealthCheck != nil {
+		if err := h.HealthCheck.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// func (j *JWT) validate() error {
+// 	var errs error
+
+// 	if err := egv1a1validation.ValidateJWTProvider(j.Providers); err != nil {
+// 		errs = errors.Join(errs, err)
+// 	}
+
+// 	return errs
+// }
+
+// RouteDestination holds the destination details associated with the route
+// +kubebuilder:object:generate=true
+type RouteDestination struct {
+	// Name of the destination. This field allows the xds layer
+	// to check if this route destination already exists and can be
+	// reused
+	Name     string                `json:"name" yaml:"name"`
+	Settings []*DestinationSetting `json:"settings,omitempty" yaml:"settings,omitempty"`
+}
+
+// Validate the fields within the RouteDestination structure
+func (r RouteDestination) Validate() error {
+	var errs error
+	if len(r.Name) == 0 {
+		errs = errors.Join(errs, ErrDestinationNameEmpty)
+	}
+	for _, s := range r.Settings {
+		if err := s.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// DestinationSetting holds the settings associated with the destination
+// +kubebuilder:object:generate=true
+type DestinationSetting struct {
+	// Weight associated with this destination.
+	// Note: Weight is not used in TCP/UDP route.
+	Weight *uint32 `json:"weight,omitempty" yaml:"weight,omitempty"`
+	// Protocol associated with this destination/port.
+	Protocol  AppProtocol            `json:"protocol" yaml:"protocol"`
+	Endpoints []*DestinationEndpoint `json:"endpoints,omitempty" yaml:"endpoints,omitempty"`
+	// AddressTypeState specifies the state of DestinationEndpoint address type.
+	AddressType *DestinationAddressType `json:"addressType,omitempty" yaml:"addressType,omitempty"`
+
+	TLS *TLSUpstreamConfig `json:"tls,omitempty" yaml:"tls,omitempty"`
+}
+
+// Validate the fields within the RouteDestination structure
+func (d DestinationSetting) Validate() error {
+	var errs error
+	for _, ep := range d.Endpoints {
+		if err := ep.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// DestinationAddressType describes the address type state for a group of DestinationEndpoint
+type DestinationAddressType string
+
+const (
+	IP    DestinationAddressType = "IP"
+	FQDN  DestinationAddressType = "FQDN"
+	MIXED DestinationAddressType = "Mixed"
+)
+
+// DestinationEndpoint holds the endpoint details associated with the destination
+// +kubebuilder:object:generate=true
+type DestinationEndpoint struct {
+	// Host refers to the FQDN or IP address of the backend service.
+	Host string `json:"host" yaml:"host"`
+	// Port on the service to forward the request to.
+	Port uint32 `json:"port" yaml:"port"`
+}
+
+// Validate the fields within the DestinationEndpoint structure
+func (d DestinationEndpoint) Validate() error {
+	var errs error
+
+	err := validation.IsDNS1123Subdomain(d.Host)
+	_, pErr := netip.ParseAddr(d.Host)
+
+	if err != nil && pErr != nil {
+		errs = errors.Join(errs, ErrDestEndpointHostInvalid)
+	}
+
+	if d.Port == 0 {
+		errs = errors.Join(errs, ErrDestEndpointPortInvalid)
+	}
+
+	return errs
+}
+
+// NewDestEndpoint creates a new DestinationEndpoint.
+func NewDestEndpoint(host string, port uint32) *DestinationEndpoint {
+	return &DestinationEndpoint{
+		Host: host,
+		Port: port,
+	}
+}
+
+// AddHeader configures a header to be added to a request or response.
+// +k8s:deepcopy-gen=true
+type AddHeader struct {
+	Name   string `json:"name" yaml:"name"`
+	Value  string `json:"value" yaml:"value"`
+	Append bool   `json:"append" yaml:"append"`
+}
+
+// Validate the fields within the AddHeader structure
+func (h AddHeader) Validate() error {
+	var errs error
+	if h.Name == "" {
+		errs = errors.Join(errs, ErrAddHeaderEmptyName)
+	}
+
+	return errs
+}
+
+// DirectResponse holds the details for returning a body and status code for a route.
+// +k8s:deepcopy-gen=true
+type DirectResponse struct {
+	// Body configures the body of the direct response. Currently only a string response
+	// is supported, but in the future a config.core.v3.DataSource may replace it.
+	Body *string `json:"body,omitempty" yaml:"body,omitempty"`
+	// StatusCode will be used for the direct response's status code.
+	StatusCode uint32 `json:"statusCode" yaml:"statusCode"`
+}
+
+// Validate the fields within the DirectResponse structure
+func (r DirectResponse) Validate() error {
+	var errs error
+	if status := r.StatusCode; status > 599 || status < 100 {
+		errs = errors.Join(errs, ErrDirectResponseStatusInvalid)
+	}
+
+	return errs
+}
+
+// URLRewrite holds the details for how to rewrite a request
+// +k8s:deepcopy-gen=true
+type URLRewrite struct {
+	// Path contains config for rewriting the path of the request.
+	Path *HTTPPathModifier `json:"path,omitempty" yaml:"path,omitempty"`
+	// Hostname configures the replacement of the request's hostname.
+	Hostname *string `json:"hostname,omitempty" yaml:"hostname,omitempty"`
+}
+
+// Validate the fields within the URLRewrite structure
+func (r URLRewrite) Validate() error {
+	var errs error
+
+	if r.Path != nil {
+		if err := r.Path.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// Redirect holds the details for how and where to redirect a request
+// +k8s:deepcopy-gen=true
+type Redirect struct {
+	// Scheme configures the replacement of the request's scheme.
+	Scheme *string `json:"scheme" yaml:"scheme"`
+	// Hostname configures the replacement of the request's hostname.
+	Hostname *string `json:"hostname" yaml:"hostname"`
+	// Path contains config for rewriting the path of the request.
+	Path *HTTPPathModifier `json:"path" yaml:"path"`
+	// Port configures the replacement of the request's port.
+	Port *uint32 `json:"port" yaml:"port"`
+	// Status code configures the redirection response's status code.
+	StatusCode *int32 `json:"statusCode" yaml:"statusCode"`
+}
+
+// Validate the fields within the Redirect structure
+func (r Redirect) Validate() error {
+	var errs error
+
+	if r.Scheme != nil {
+		if *r.Scheme != "http" && *r.Scheme != "https" {
+			errs = errors.Join(errs, ErrRedirectUnsupportedScheme)
+		}
+	}
+
+	if r.Path != nil {
+		if err := r.Path.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	if r.StatusCode != nil {
+		if *r.StatusCode != 301 && *r.StatusCode != 302 {
+			errs = errors.Join(errs, ErrRedirectUnsupportedStatus)
+		}
+	}
+
+	return errs
+}
+
+// HTTPPathModifier holds instructions for how to modify the path of a request on a redirect response
+// +k8s:deepcopy-gen=true
+type HTTPPathModifier struct {
+	// FullReplace provides a string to replace the full path of the request.
+	FullReplace *string `json:"fullReplace" yaml:"fullReplace"`
+	// PrefixMatchReplace provides a string to replace the matched prefix of the request.
+	PrefixMatchReplace *string `json:"prefixMatchReplace" yaml:"prefixMatchReplace"`
+}
+
+// Validate the fields within the HTTPPathModifier structure
+func (r HTTPPathModifier) Validate() error {
+	var errs error
+
+	if r.FullReplace != nil && r.PrefixMatchReplace != nil {
+		errs = errors.Join(errs, ErrHTTPPathModifierDoubleReplace)
+	}
+
+	if r.FullReplace == nil && r.PrefixMatchReplace == nil {
+		errs = errors.Join(errs, ErrHTTPPathModifierNoReplace)
+	}
+
+	return errs
+}
+
+// StringMatch holds the various match conditions.
+// Only one of Exact, Prefix, SafeRegex or Distinct can be set.
+// +k8s:deepcopy-gen=true
+type StringMatch struct {
+	// Name of the field to match on.
+	Name string `json:"name" yaml:"name"`
+	// Exact match condition.
+	Exact *string `json:"exact,omitempty" yaml:"exact,omitempty"`
+	// Prefix match condition.
+	Prefix *string `json:"prefix,omitempty" yaml:"prefix,omitempty"`
+	// Suffix match condition.
+	Suffix *string `json:"suffix,omitempty" yaml:"suffix,omitempty"`
+	// SafeRegex match condition.
+	SafeRegex *string `json:"safeRegex,omitempty" yaml:"safeRegex,omitempty"`
+	// Distinct match condition.
+	// Used to match any and all possible unique values encountered within the Name field.
+	Distinct bool `json:"distinct" yaml:"distinct"`
+}
+
+// Validate the fields within the StringMatch structure
+func (s StringMatch) Validate() error {
+	var errs error
+	matchCount := 0
+	if s.Exact != nil {
+		matchCount++
+	}
+	if s.Prefix != nil {
+		matchCount++
+	}
+	if s.Suffix != nil {
+		matchCount++
+	}
+	if s.SafeRegex != nil {
+		matchCount++
+	}
+	if s.Distinct {
+		if s.Name == "" {
+			errs = errors.Join(errs, ErrStringMatchNameIsEmpty)
+		}
+		matchCount++
+	}
+
+	if matchCount != 1 {
+		errs = errors.Join(errs, ErrStringMatchConditionInvalid)
+	}
+
+	return errs
+}
+
+// TCPListener holds the TCP listener configuration.
+// +k8s:deepcopy-gen=true
+type TCPListener struct {
+	// Name of the TCPListener
+	Name string `json:"name" yaml:"name"`
+	// Address that the listener should listen on.
+	Address string `json:"address" yaml:"address"`
+	// Port on which the service can be expected to be accessed by clients.
+	Port uint32 `json:"port" yaml:"port"`
+	// TLS holds information for configuring TLS on a listener
+	TLS *TLS `json:"tls,omitempty" yaml:"tls,omitempty"`
+	// Destinations associated with TCP traffic to the service.
+	Destination *RouteDestination `json:"destination,omitempty" yaml:"destination,omitempty"`
+	// TCPKeepalive configuration for the listener
+	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty" yaml:"tcpKeepalive,omitempty"`
+}
+
+// TLS holds information for configuring TLS on a listener
+// +k8s:deepcopy-gen=true
+type TLS struct {
+	// TLS information required for TLS Passthrough, If provided, incoming
+	// connections' server names are inspected and routed to backends accordingly.
+	Passthrough *TLSInspectorConfig `json:"passthrough,omitempty" yaml:"passthrough,omitempty"`
+	// TLS information required for TLS Termination
+	Terminate *TLSConfig `json:"terminate,omitempty" yaml:"terminate,omitempty"`
+}
+
+// Validate the fields within the TCPListener structure
+func (h TCPListener) Validate() error {
+	var errs error
+	if h.Name == "" {
+		errs = errors.Join(errs, ErrListenerNameEmpty)
+	}
+	if _, err := netip.ParseAddr(h.Address); err != nil {
+		errs = errors.Join(errs, ErrListenerAddressInvalid)
+	}
+	if h.Port == 0 {
+		errs = errors.Join(errs, ErrListenerPortInvalid)
+	}
+	if h.TLS != nil && h.TLS.Passthrough != nil {
+		if err := h.TLS.Passthrough.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	if h.TLS != nil && h.TLS.Terminate != nil {
+		if err := h.TLS.Terminate.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	if h.Destination != nil {
+		if err := h.Destination.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+// TLSInspectorConfig holds the configuration required for inspecting TLS
+// passthrough connections.
+// +k8s:deepcopy-gen=true
+type TLSInspectorConfig struct {
+	// Server names that are compared against the server names of a new connection.
+	// Wildcard hosts are supported in the prefix form. Partial wildcards are not
+	// supported, and values like *w.example.com are invalid.
+	// SNIs are used only in case of TLS Passthrough.
+	SNIs []string `json:"snis,omitempty" yaml:"snis,omitempty"`
+}
+
+func (t TLSInspectorConfig) Validate() error {
+	var errs error
+	if len(t.SNIs) == 0 {
+		errs = errors.Join(errs, ErrTCPListenerSNIsEmpty)
+	}
+	return errs
+}
+
+// UDPListener holds the UDP listener configuration.
+// +k8s:deepcopy-gen=true
+type UDPListener struct {
+	// Name of the UDPListener
+	Name string `json:"name" yaml:"name"`
+	// Address that the listener should listen on.
+	Address string `json:"address" yaml:"address"`
+	// Port on which the service can be expected to be accessed by clients.
+	Port uint32 `json:"port" yaml:"port"`
+	// Destination associated with UDP traffic to the service.
+	Destination *RouteDestination `json:"destination,omitempty" yaml:"destination,omitempty"`
+}
+
+// Validate the fields within the UDPListener structure
+func (h UDPListener) Validate() error {
+	var errs error
+	if h.Name == "" {
+		errs = errors.Join(errs, ErrListenerNameEmpty)
+	}
+	if _, err := netip.ParseAddr(h.Address); err != nil {
+		errs = errors.Join(errs, ErrListenerAddressInvalid)
+	}
+	if h.Port == 0 {
+		errs = errors.Join(errs, ErrListenerPortInvalid)
+	}
+	if h.Destination != nil {
+		if err := h.Destination.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// RateLimit holds the rate limiting configuration.
+// +k8s:deepcopy-gen=true
+type RateLimit struct {
+	// Global rate limit settings.
+	Global *GlobalRateLimit `json:"global,omitempty" yaml:"global,omitempty"`
+
+	// Local rate limit settings.
+	Local *LocalRateLimit `json:"local,omitempty" yaml:"local,omitempty"`
+}
+
+// GlobalRateLimit holds the global rate limiting configuration.
+// +k8s:deepcopy-gen=true
+type GlobalRateLimit struct {
+	// TODO zhaohuabing: add default values for Global rate limiting.
+
+	// Rules for rate limiting.
+	Rules []*RateLimitRule `json:"rules,omitempty" yaml:"rules,omitempty"`
+}
+
+// LocalRateLimit holds the local rate limiting configuration.
+// +k8s:deepcopy-gen=true
+type LocalRateLimit struct {
+	// Default rate limiting values.
+	// If a request does not match any of the rules, the default values are used.
+	Default RateLimitValue `json:"default,omitempty" yaml:"default,omitempty"`
+
+	// Rules for rate limiting.
+	Rules []*RateLimitRule `json:"rules,omitempty" yaml:"rules,omitempty"`
+}
+
+// RateLimitRule holds the match and limit configuration for ratelimiting.
+// +k8s:deepcopy-gen=true
+type RateLimitRule struct {
+	// HeaderMatches define the match conditions on the request headers for this route.
+	HeaderMatches []*StringMatch `json:"headerMatches" yaml:"headerMatches"`
+	// CIDRMatch define the match conditions on the source IP's CIDR for this route.
+	CIDRMatch *CIDRMatch `json:"cidrMatch,omitempty" yaml:"cidrMatch,omitempty"`
+	// Limit holds the rate limit values.
+	Limit RateLimitValue `json:"limit,omitempty" yaml:"limit,omitempty"`
+}
+
+type CIDRMatch struct {
+	CIDR    string `json:"cidr" yaml:"cidr"`
+	IPv6    bool   `json:"ipv6" yaml:"ipv6"`
+	MaskLen int    `json:"maskLen" yaml:"maskLen"`
+	// Distinct means that each IP Address within the specified Source IP CIDR is treated as a distinct client selector
+	// and uses a separate rate limit bucket/counter.
+	Distinct bool `json:"distinct" yaml:"distinct"`
+}
+
+// TODO zhaohuabing: remove this function
+func (r *RateLimitRule) IsMatchSet() bool {
+	return len(r.HeaderMatches) != 0 || r.CIDRMatch != nil
+}
+
+// type RateLimitUnit egv1a1.RateLimitUnit
+
+// RateLimitValue holds the
+// +k8s:deepcopy-gen=true
+type RateLimitValue struct {
+	// Requests are the number of requests that need to be rate limited.
+	Requests uint `json:"requests" yaml:"requests"`
+	// Unit of rate limiting.
+	// Unit RateLimitUnit `json:"unit" yaml:"unit"`
+}
+
+// AccessLog holds the access logging configuration.
+// +k8s:deepcopy-gen=true
+type AccessLog struct {
+	Text          []*TextAccessLog          `json:"text,omitempty" yaml:"text,omitempty"`
+	JSON          []*JSONAccessLog          `json:"json,omitempty" yaml:"json,omitempty"`
+	OpenTelemetry []*OpenTelemetryAccessLog `json:"openTelemetry,omitempty" yaml:"openTelemetry,omitempty"`
+}
+
+// TextAccessLog holds the configuration for text access logging.
+// +k8s:deepcopy-gen=true
+type TextAccessLog struct {
+	Format *string `json:"format,omitempty" yaml:"format,omitempty"`
+	Path   string  `json:"path" yaml:"path"`
+}
+
+// JSONAccessLog holds the configuration for JSON access logging.
+// +k8s:deepcopy-gen=true
+type JSONAccessLog struct {
+	JSON map[string]string `json:"json,omitempty" yaml:"json,omitempty"`
+	Path string            `json:"path" yaml:"path"`
+}
+
+// OpenTelemetryAccessLog holds the configuration for OpenTelemetry access logging.
+// +k8s:deepcopy-gen=true
+type OpenTelemetryAccessLog struct {
+	Text       *string           `json:"text,omitempty" yaml:"text,omitempty"`
+	Attributes map[string]string `json:"attributes,omitempty" yaml:"attributes,omitempty"`
+	Host       string            `json:"host" yaml:"host"`
+	Port       uint32            `json:"port" yaml:"port"`
+	Resources  map[string]string `json:"resources,omitempty" yaml:"resources,omitempty"`
+}
+
+// JSONPatchConfig defines the configuration for patching a Envoy xDS Resource
+// using JSONPatch semantics
+// +k8s:deepcopy-gen=true
+type JSONPatchConfig struct {
+	// Type is the typed URL of the Envoy xDS Resource
+	Type string `json:"type" yaml:"type"`
+	// Name is the name of the resource
+	Name string `json:"name" yaml:"name"`
+	// Patch defines the JSON Patch Operation
+	Operation JSONPatchOperation `json:"operation" yaml:"operation"`
+}
+
+// JSONPatchOperation defines the JSON Patch Operation as defined in
+// https://datatracker.ietf.org/doc/html/rfc6902
+// +k8s:deepcopy-gen=true
+type JSONPatchOperation struct {
+	// Op is the type of operation to perform
+	Op string `json:"op" yaml:"op"`
+	// Path is the location of the target document/field where the operation will be performed
+	// Refer to https://datatracker.ietf.org/doc/html/rfc6901 for more details.
+	Path string `json:"path" yaml:"path"`
+	// From is the source location of the value to be copied or moved. Only valid
+	// for move or copy operations
+	// Refer to https://datatracker.ietf.org/doc/html/rfc6901 for more details.
+	// +optional
+	From *string `json:"from,omitempty" yaml:"from,omitempty"`
+	// Value is the new value of the path location.
+	Value *apiextensionsv1.JSON `json:"value,omitempty" yaml:"value,omitempty"`
+}
+
+// Tracing defines the configuration for tracing a Envoy xDS Resource
+// +k8s:deepcopy-gen=true
+type Tracing struct {
+	ServiceName string `json:"serviceName"`
+
+	egv1a1.ProxyTracing
+}
+
+// Metrics defines the configuration for metrics generated by Envoy
+// +k8s:deepcopy-gen=true
+type Metrics struct {
+	EnableVirtualHostStats bool `json:"enableVirtualHostStats" yaml:"enableVirtualHostStats"`
+}
+
+// TCPKeepalive define the TCP Keepalive configuration.
+// +k8s:deepcopy-gen=true
+type TCPKeepalive struct {
+	// The total number of unacknowledged probes to send before deciding
+	// the connection is dead.
+	// Defaults to 9.
+	Probes *uint32 `json:"probes,omitempty" yaml:"probes,omitempty"`
+	// The duration, in seconds, a connection needs to be idle before keep-alive
+	// probes start being sent.
+	// Defaults to `7200s`.
+	IdleTime *uint32 `json:"idleTime,omitempty" yaml:"idleTime,omitempty"`
+	// The duration, in seconds, between keep-alive probes.
+	// Defaults to `75s`.
+	Interval *uint32 `json:"interval,omitempty" yaml:"interval,omitempty"`
+}
+
+// LoadBalancer defines the load balancer settings.
+// +k8s:deepcopy-gen=true
+type LoadBalancer struct {
+	// RoundRobin load balacning policy
+	RoundRobin *RoundRobin `json:"roundRobin,omitempty" yaml:"roundRobin,omitempty"`
+	// LeastRequest load balancer policy
+	LeastRequest *LeastRequest `json:"leastRequest,omitempty" yaml:"leastRequest,omitempty"`
+	// Random load balancer policy
+	Random *Random `json:"random,omitempty" yaml:"random,omitempty"`
+	// ConsistentHash load balancer policy
+	ConsistentHash *ConsistentHash `json:"consistentHash,omitempty" yaml:"consistentHash,omitempty"`
+}
+
+// Validate the fields within the LoadBalancer structure
+func (l *LoadBalancer) Validate() error {
+	var errs error
+	matchCount := 0
+	if l.RoundRobin != nil {
+		matchCount++
+	}
+	if l.LeastRequest != nil {
+		matchCount++
+	}
+	if l.Random != nil {
+		matchCount++
+	}
+	if l.ConsistentHash != nil {
+		matchCount++
+	}
+	if matchCount != 1 {
+		errs = errors.Join(errs, ErrLoadBalancerInvalid)
+	}
+
+	return errs
+}
+
+// RoundRobin load balancer settings
+// +k8s:deepcopy-gen=true
+type RoundRobin struct {
+	// SlowStart defines the slow start configuration.
+	// If set, slow start mode is enabled for newly added hosts in the cluster.
+	SlowStart *SlowStart `json:"slowStart,omitempty" yaml:"slowStart,omitempty"`
+}
+
+// LeastRequest load balancer settings
+// +k8s:deepcopy-gen=true
+type LeastRequest struct {
+	// SlowStart defines the slow start configuration.
+	// If set, slow start mode is enabled for newly added hosts in the cluster.
+	SlowStart *SlowStart `json:"slowStart,omitempty" yaml:"slowStart,omitempty"`
+}
+
+// Random load balancer settings
+// +k8s:deepcopy-gen=true
+type Random struct{}
+
+// ConsistentHash load balancer settings
+// +k8s:deepcopy-gen=true
+type ConsistentHash struct {
+	// Hash based on the Source IP Address
+	SourceIP *bool `json:"sourceIP,omitempty" yaml:"sourceIP,omitempty"`
+}
+
+type ProxyProtocolVersion string
+
+const (
+	// ProxyProtocolVersionV1 is the PROXY protocol version 1 (human readable format).
+	ProxyProtocolVersionV1 ProxyProtocolVersion = "V1"
+	// ProxyProtocolVersionV2 is the PROXY protocol version 2 (binary format).
+	ProxyProtocolVersionV2 ProxyProtocolVersion = "V2"
+)
+
+// ProxyProtocol upstream settings
+// +k8s:deepcopy-gen=true
+type ProxyProtocol struct {
+	// Version of proxy protocol to use
+	Version ProxyProtocolVersion `json:"version,omitempty" yaml:"version,omitempty"`
+}
+
+// SlowStart defines the slow start configuration.
+// +k8s:deepcopy-gen=true
+type SlowStart struct {
+	// Window defines the duration of the warm up period for newly added host.
+	Window *metav1.Duration `json:"window" yaml:"window"`
+}
+
+// Backend CircuitBreaker settings for the DEFAULT routing priority
+// +k8s:deepcopy-gen=true
+type CircuitBreaker struct {
+	// The maximum number of connections that Envoy will establish.
+	MaxConnections *uint32 `json:"maxConnections,omitempty" yaml:"maxConnections,omitempty"`
+
+	// The maximum number of pending requests that Envoy will queue.
+	MaxPendingRequests *uint32 `json:"maxPendingRequests,omitempty" yaml:"maxPendingRequests,omitempty"`
+
+	// The maximum number of parallel requests that Envoy will make.
+	MaxParallelRequests *uint32 `json:"maxParallelRequests,omitempty" yaml:"maxParallelRequests,omitempty"`
+
+	// The maximum number of parallel requests that Envoy will make.
+	MaxRequestsPerConnection *uint32 `json:"maxRequestsPerConnection,omitempty" yaml:"maxRequestsPerConnection,omitempty"`
+
+	// The maximum number of parallel retries that Envoy will make.
+	MaxParallelRetries *uint32 `json:"maxParallelRetries,omitempty" yaml:"maxParallelRetries,omitempty"`
+}
+
+// HealthCheck defines health check settings
+// +k8s:deepcopy-gen=true
+type HealthCheck struct {
+	Active *ActiveHealthCheck `json:"active,omitempty" yaml:"active,omitempty"`
+
+	Passive *OutlierDetection `json:"passive,omitempty" yaml:"passive,omitempty"`
+}
+
+// OutlierDetection defines passive health check settings
+// +k8s:deepcopy-gen=true
+type OutlierDetection struct {
+	// Interval defines the time between passive health checks.
+	Interval *metav1.Duration `json:"interval,omitempty"`
+	// SplitExternalLocalOriginErrors enables splitting of errors between external and local origin.
+	SplitExternalLocalOriginErrors *bool `json:"splitExternalLocalOriginErrors,omitempty" yaml:"splitExternalLocalOriginErrors,omitempty"`
+	// ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.
+	ConsecutiveLocalOriginFailures *uint32 `json:"consecutiveLocalOriginFailures,omitempty" yaml:"consecutiveLocalOriginFailures,omitempty"`
+	// ConsecutiveGatewayErrors sets the number of consecutive gateway errors triggering ejection.
+	ConsecutiveGatewayErrors *uint32 `json:"consecutiveGatewayErrors,omitempty" yaml:"consecutiveGatewayErrors,omitempty"`
+	// Consecutive5xxErrors sets the number of consecutive 5xx errors triggering ejection.
+	Consecutive5xxErrors *uint32 `json:"consecutive5XxErrors,omitempty" yaml:"consecutive5XxErrors,omitempty"`
+	// BaseEjectionTime defines the base duration for which a host will be ejected on consecutive failures.
+	BaseEjectionTime *metav1.Duration `json:"baseEjectionTime,omitempty" yaml:"baseEjectionTime,omitempty"`
+	// MaxEjectionPercent sets the maximum percentage of hosts in a cluster that can be ejected.
+	MaxEjectionPercent *int32 `json:"maxEjectionPercent,omitempty" yaml:"maxEjectionPercent,omitempty"`
+}
+
+// ActiveHealthCheck defines active health check settings
+// +k8s:deepcopy-gen=true
+type ActiveHealthCheck struct {
+	// Timeout defines the time to wait for a health check response.
+	Timeout *metav1.Duration `json:"timeout"`
+	// Interval defines the time between active health checks.
+	Interval *metav1.Duration `json:"interval"`
+	// UnhealthyThreshold defines the number of unhealthy health checks required before a backend host is marked unhealthy.
+	UnhealthyThreshold *uint32 `json:"unhealthyThreshold"`
+	// HealthyThreshold defines the number of healthy health checks required before a backend host is marked healthy.
+	HealthyThreshold *uint32 `json:"healthyThreshold"`
+	// HTTP defines the configuration of http health checker.
+	HTTP *HTTPHealthChecker `json:"http,omitempty" yaml:"http,omitempty"`
+	// TCP defines the configuration of tcp health checker.
+	TCP *TCPHealthChecker `json:"tcp,omitempty" yaml:"tcp,omitempty"`
+}
+
+func (h *HealthCheck) SetHTTPHostIfAbsent(host string) {
+	if h != nil && h.Active != nil && h.Active.HTTP != nil && h.Active.HTTP.Host == "" {
+		h.Active.HTTP.Host = host
+	}
+}
+
+// Validate the fields within the HealthCheck structure.
+func (h *HealthCheck) Validate() error {
+	var errs error
+	if h.Active != nil {
+		if h.Active.Timeout != nil && h.Active.Timeout.Duration == 0 {
+			errs = errors.Join(errs, ErrHealthCheckTimeoutInvalid)
+		}
+		if h.Active.Interval != nil && h.Active.Interval.Duration == 0 {
+			errs = errors.Join(errs, ErrHealthCheckIntervalInvalid)
+		}
+		if h.Active.UnhealthyThreshold != nil && *h.Active.UnhealthyThreshold == 0 {
+			errs = errors.Join(errs, ErrHealthCheckUnhealthyThresholdInvalid)
+		}
+		if h.Active.HealthyThreshold != nil && *h.Active.HealthyThreshold == 0 {
+			errs = errors.Join(errs, ErrHealthCheckHealthyThresholdInvalid)
+		}
+
+		matchCount := 0
+		if h.Active.HTTP != nil {
+			matchCount++
+		}
+		if h.Active.TCP != nil {
+			matchCount++
+		}
+		if matchCount > 1 {
+			errs = errors.Join(errs, ErrHealthCheckerInvalid)
+		}
+
+		if h.Active.HTTP != nil {
+			if err := h.Active.HTTP.Validate(); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+		if h.Active.TCP != nil {
+			if err := h.Active.TCP.Validate(); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+
+	if h.Passive != nil {
+		if h.Passive.BaseEjectionTime != nil && h.Passive.BaseEjectionTime.Duration == 0 {
+			errs = errors.Join(errs, ErrOutlierDetectionBaseEjectionTimeInvalid)
+		}
+
+		if h.Passive.Interval != nil && h.Passive.Interval.Duration == 0 {
+			errs = errors.Join(errs, ErrOutlierDetectionIntervalInvalid)
+		}
+	}
+
+	return errs
+}
+
+// HTTPHealthChecker defines the settings of http health check.
+// +k8s:deepcopy-gen=true
+type HTTPHealthChecker struct {
+	// Host defines the value of the host header in the HTTP health check request.
+	Host string `json:"host" yaml:"host"`
+	// Path defines the HTTP path that will be requested during health checking.
+	Path string `json:"path" yaml:"path"`
+	// Method defines the HTTP method used for health checking.
+	Method *string `json:"method,omitempty" yaml:"method,omitempty"`
+	// ExpectedStatuses defines a list of HTTP response statuses considered healthy.
+	ExpectedStatuses []HTTPStatus `json:"expectedStatuses,omitempty" yaml:"expectedStatuses,omitempty"`
+	// ExpectedResponse defines a list of HTTP expected responses to match.
+	ExpectedResponse *HealthCheckPayload `json:"expectedResponse,omitempty" yaml:"expectedResponses,omitempty"`
+}
+
+// Validate the fields within the HTTPHealthChecker structure.
+func (c *HTTPHealthChecker) Validate() error {
+	var errs error
+	if c.Host == "" {
+		errs = errors.Join(errs, ErrHCHTTPHostInvalid)
+	}
+	if c.Path == "" {
+		errs = errors.Join(errs, ErrHCHTTPPathInvalid)
+	}
+	if c.Method != nil {
+		switch *c.Method {
+		case http.MethodGet:
+		case http.MethodHead:
+		case http.MethodPost:
+		case http.MethodPut:
+		case http.MethodDelete:
+		case http.MethodOptions:
+		case http.MethodTrace:
+		case http.MethodPatch:
+		case "":
+		default:
+			errs = errors.Join(errs, ErrHCHTTPMethodInvalid)
+		}
+	}
+	if len(c.ExpectedStatuses) == 0 {
+		errs = errors.Join(errs, ErrHCHTTPExpectedStatusesInvalid)
+	}
+	for _, r := range c.ExpectedStatuses {
+		if err := r.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if c.ExpectedResponse != nil {
+		if err := c.ExpectedResponse.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+// HTTPStatus represents http status code.
+type HTTPStatus int
+
+func (h HTTPStatus) Validate() error {
+	if h < 100 || h >= 600 {
+		return ErrHTTPStatusInvalid
+	}
+	return nil
+}
+
+// TCPHealthChecker defines the settings of tcp health check.
+// +k8s:deepcopy-gen=true
+type TCPHealthChecker struct {
+	Send    *HealthCheckPayload `json:"send,omitempty" yaml:"send,omitempty"`
+	Receive *HealthCheckPayload `json:"receive,omitempty" yaml:"receive,omitempty"`
+}
+
+// Validate the fields within the TCPHealthChecker structure.
+func (c *TCPHealthChecker) Validate() error {
+	var errs error
+	if c.Send != nil {
+		if err := c.Send.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if c.Receive != nil {
+		if err := c.Receive.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+// HealthCheckPayload defines the encoding of the payload bytes in the payload.
+// +k8s:deepcopy-gen=true
+type HealthCheckPayload struct {
+	// Text payload in plain text.
+	Text *string `json:"text,omitempty" yaml:"text,omitempty"`
+	// Binary payload base64 encoded
+	Binary []byte `json:"binary,omitempty" yaml:"binary,omitempty"`
+}
+
+// Validate the fields in the HealthCheckPayload.
+func (p *HealthCheckPayload) Validate() error {
+	var errs error
+	matchCount := 0
+	if p.Text != nil && *p.Text != "" {
+		matchCount++
+	}
+	if len(p.Binary) > 0 {
+		matchCount++
+	}
+	if matchCount != 1 {
+		errs = errors.Join(errs, ErrHealthCheckPayloadInvalid)
+	}
+	return errs
+}
+
+// Backend connection timeout settings
+// +k8s:deepcopy-gen=true
+type Timeout struct {
+	// Timeout settings for TCP.
+	TCP *TCPTimeout `json:"tcp,omitempty" yaml:"tcp,omitempty"`
+
+	// Timeout settings for HTTP.
+	HTTP *HTTPTimeout `json:"http,omitempty" yaml:"tcp,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type TCPTimeout struct {
+	// The timeout for network connection establishment, including TCP and TLS handshakes.
+	ConnectTimeout *metav1.Duration `json:"connectTimeout,omitempty" yaml:"connectTimeout,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type HTTPTimeout struct {
+	// RequestTimeout is the time until which entire response is received from the upstream.
+	RequestTimeout *metav1.Duration `json:"requestTimeout,omitempty" yaml:"requestTimeout,omitempty"`
+
+	// The idle timeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
+	ConnectionIdleTimeout *metav1.Duration `json:"connectionIdleTimeout,omitempty" yaml:"connectionIdleTimeout,omitempty"`
+
+	// The maximum duration of an HTTP connection.
+	MaxConnectionDuration *metav1.Duration `json:"maxConnectionDuration,omitempty" yaml:"maxConnectionDuration,omitempty"`
+}
+
+// Retry define the retry policy configuration.
+// +k8s:deepcopy-gen=true
+type Retry struct {
+	// NumRetries is the number of retries to be attempted. Defaults to 2.
+	NumRetries *uint32 `json:"numRetries,omitempty"`
+
+	// RetryOn specifies the retry trigger condition.
+	RetryOn *RetryOn `json:"retryOn,omitempty"`
+
+	// PerRetry is the retry policy to be applied per retry attempt.
+	PerRetry *PerRetryPolicy `json:"perRetry,omitempty"`
+}
+
+type TriggerEnum egv1a1.TriggerEnum
+
+const (
+	Error5XX             = TriggerEnum(egv1a1.Error5XX)
+	GatewayError         = TriggerEnum(egv1a1.GatewayError)
+	Reset                = TriggerEnum(egv1a1.Reset)
+	ConnectFailure       = TriggerEnum(egv1a1.ConnectFailure)
+	Retriable4XX         = TriggerEnum(egv1a1.Retriable4XX)
+	RefusedStream        = TriggerEnum(egv1a1.RefusedStream)
+	RetriableStatusCodes = TriggerEnum(egv1a1.RetriableStatusCodes)
+	Cancelled            = TriggerEnum(egv1a1.Cancelled)
+	DeadlineExceeded     = TriggerEnum(egv1a1.DeadlineExceeded)
+	Internal             = TriggerEnum(egv1a1.Internal)
+	ResourceExhausted    = TriggerEnum(egv1a1.ResourceExhausted)
+	Unavailable          = TriggerEnum(egv1a1.Unavailable)
+)
+
+// +k8s:deepcopy-gen=true
+type RetryOn struct {
+	// Triggers specifies the retry trigger condition(Http/Grpc).
+	Triggers []TriggerEnum `json:"triggers,omitempty"`
+
+	// HttpStatusCodes specifies the http status codes to be retried.
+	HTTPStatusCodes []HTTPStatus `json:"httpStatusCodes,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type PerRetryPolicy struct {
+	// Timeout is the timeout per retry attempt.
+	Timeout *metav1.Duration `json:"timeout,omitempty"`
+	// Backoff is the backoff policy to be applied per retry attempt.
+	BackOff *BackOffPolicy `json:"backOff,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type BackOffPolicy struct {
+	// BaseInterval is the base interval between retries.
+	BaseInterval *metav1.Duration `json:"baseInterval,omitempty"`
+	// MaxInterval is the maximum interval between retries.
+	MaxInterval *metav1.Duration `json:"maxInterval,omitempty"`
+}
+
+// TLSUpstreamConfig contains sni and ca file in []byte format.
+// +k8s:deepcopy-gen=true
+type TLSUpstreamConfig struct {
+	SNI                 string            `json:"sni,omitempty" yaml:"sni,omitempty"`
+	UseSystemTrustStore bool              `json:"useSystemTrustStore,omitempty" yaml:"useSystemTrustStore,omitempty"`
+	CACertificate       *TLSCACertificate `json:"caCertificate,omitempty" yaml:"caCertificate,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/ir/xds_test.go b/adapter/internal/operator/gateway-api/ir/xds_test.go
new file mode 100644
index 000000000..c2c9b1aac
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/xds_test.go
@@ -0,0 +1,1438 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package ir
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
+)
+
+var (
+	// HTTPListener
+	happyHTTPListener = HTTPListener{
+		Name:      "happy",
+		Address:   "0.0.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		Routes:    []*HTTPRoute{&happyHTTPRoute},
+	}
+	happyHTTPSListener = HTTPListener{
+		Name:      "happy",
+		Address:   "0.0.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		TLS: &TLSConfig{
+			Certificates: []TLSCertificate{{
+
+				Name:              "happy",
+				ServerCertificate: []byte{1, 2, 3},
+				PrivateKey:        []byte{1, 2, 3},
+			}}},
+		Routes: []*HTTPRoute{&happyHTTPRoute},
+	}
+	redactedHappyHTTPSListener = HTTPListener{
+		Name:      "happy",
+		Address:   "0.0.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		TLS: &TLSConfig{
+			Certificates: []TLSCertificate{{
+
+				Name:              "happy",
+				ServerCertificate: []byte{1, 2, 3},
+				PrivateKey:        redacted,
+			}}},
+		Routes: []*HTTPRoute{&happyHTTPRoute},
+	}
+	invalidAddrHTTPListener = HTTPListener{
+		Name:      "invalid-addr",
+		Address:   "1.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		Routes:    []*HTTPRoute{&happyHTTPRoute},
+	}
+	invalidBackendHTTPListener = HTTPListener{
+		Name:      "invalid-backend-match",
+		Address:   "0.0.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		Routes:    []*HTTPRoute{&invalidBackendHTTPRoute},
+	}
+	weightedInvalidBackendsHTTPListener = HTTPListener{
+		Name:      "weighted-invalid-backends-match",
+		Address:   "0.0.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		Routes:    []*HTTPRoute{&weightedInvalidBackendsHTTPRoute},
+	}
+
+	// TCPListener
+	happyTCPListenerTLSPassthrough = TCPListener{
+		Name:        "happy",
+		Address:     "0.0.0.0",
+		Port:        80,
+		TLS:         &TLS{Passthrough: &TLSInspectorConfig{SNIs: []string{"example.com"}}},
+		Destination: &happyRouteDestination,
+	}
+
+	happyTCPListenerTLSTerminate = TCPListener{
+		Name:    "happy",
+		Address: "0.0.0.0",
+		Port:    80,
+		TLS: &TLS{Terminate: &TLSConfig{
+			Certificates: []TLSCertificate{{
+				Name:              "happy",
+				ServerCertificate: []byte("server-cert"),
+				PrivateKey:        []byte("priv-key"),
+			}}}},
+		Destination: &happyRouteDestination,
+	}
+
+	emptySNITCPListenerTLSPassthrough = TCPListener{
+		Name:        "empty-sni",
+		Address:     "0.0.0.0",
+		Port:        80,
+		Destination: &happyRouteDestination,
+	}
+	invalidNameTCPListenerTLSPassthrough = TCPListener{
+		Address:     "0.0.0.0",
+		Port:        80,
+		TLS:         &TLS{Passthrough: &TLSInspectorConfig{SNIs: []string{"example.com"}}},
+		Destination: &happyRouteDestination,
+	}
+	invalidAddrTCPListenerTLSPassthrough = TCPListener{
+		Name:        "invalid-addr",
+		Address:     "1.0.0",
+		Port:        80,
+		TLS:         &TLS{Passthrough: &TLSInspectorConfig{SNIs: []string{"example.com"}}},
+		Destination: &happyRouteDestination,
+	}
+	invalidSNITCPListenerTLSPassthrough = TCPListener{
+		Address:     "0.0.0.0",
+		Port:        80,
+		TLS:         &TLS{Passthrough: &TLSInspectorConfig{SNIs: []string{}}},
+		Destination: &happyRouteDestination,
+	}
+
+	// UDPListener
+	happyUDPListener = UDPListener{
+		Name:        "happy",
+		Address:     "0.0.0.0",
+		Port:        80,
+		Destination: &happyRouteDestination,
+	}
+	invalidNameUDPListener = UDPListener{
+		Address:     "0.0.0.0",
+		Port:        80,
+		Destination: &happyRouteDestination,
+	}
+	invalidAddrUDPListener = UDPListener{
+		Name:        "invalid-addr",
+		Address:     "1.0.0",
+		Port:        80,
+		Destination: &happyRouteDestination,
+	}
+	invalidPortUDPListenerT = UDPListener{
+		Name:        "invalid-port",
+		Address:     "0.0.0.0",
+		Port:        0,
+		Destination: &happyRouteDestination,
+	}
+
+	// HTTPRoute
+	happyHTTPRoute = HTTPRoute{
+		Name:     "happy",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("example"),
+		},
+		Destination: &happyRouteDestination,
+	}
+	invalidBackendHTTPRoute = HTTPRoute{
+		Name:     "invalid-backend",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("invalid-backend"),
+		},
+		BackendWeights: BackendWeights{
+			Invalid: 1,
+		},
+	}
+	weightedInvalidBackendsHTTPRoute = HTTPRoute{
+		Name:     "weighted-invalid-backends",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("invalid-backends"),
+		},
+		Destination: &happyRouteDestination,
+		BackendWeights: BackendWeights{
+			Invalid: 1,
+			Valid:   1,
+		},
+	}
+
+	redirectHTTPRoute = HTTPRoute{
+		Name:     "redirect",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("redirect"),
+		},
+		Redirect: &Redirect{
+			Scheme:   ptr.To("https"),
+			Hostname: ptr.To("redirect.example.com"),
+			Path: &HTTPPathModifier{
+				FullReplace: ptr.To("/redirect"),
+			},
+			Port:       ptr.To(uint32(8443)),
+			StatusCode: ptr.To[int32](301),
+		},
+	}
+	// A direct response error is used when an invalid filter type is supplied
+	invalidFilterHTTPRoute = HTTPRoute{
+		Name:     "filter-error",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("filter-error"),
+		},
+		DirectResponse: &DirectResponse{
+			Body:       ptr.To("invalid filter type"),
+			StatusCode: uint32(500),
+		},
+	}
+
+	redirectFilterInvalidStatus = HTTPRoute{
+		Name:     "redirect-bad-status-scheme-nopat",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("redirect"),
+		},
+		Redirect: &Redirect{
+			Scheme:     ptr.To("err"),
+			Hostname:   ptr.To("redirect.example.com"),
+			Path:       &HTTPPathModifier{},
+			Port:       ptr.To(uint32(8443)),
+			StatusCode: ptr.To[int32](305),
+		},
+	}
+	redirectFilterBadPath = HTTPRoute{
+		Name:     "redirect",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("redirect"),
+		},
+		Redirect: &Redirect{
+			Scheme:   ptr.To("https"),
+			Hostname: ptr.To("redirect.example.com"),
+			Path: &HTTPPathModifier{
+				FullReplace:        ptr.To("/redirect"),
+				PrefixMatchReplace: ptr.To("/redirect"),
+			},
+			Port:       ptr.To(uint32(8443)),
+			StatusCode: ptr.To[int32](301),
+		},
+	}
+	directResponseBadStatus = HTTPRoute{
+		Name:     "redirect",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("redirect"),
+		},
+		DirectResponse: &DirectResponse{
+			Body:       ptr.To("invalid filter type"),
+			StatusCode: uint32(799),
+		},
+	}
+
+	urlRewriteHTTPRoute = HTTPRoute{
+		Name:     "rewrite",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("rewrite"),
+		},
+		URLRewrite: &URLRewrite{
+			Hostname: ptr.To("rewrite.example.com"),
+			Path: &HTTPPathModifier{
+				FullReplace: ptr.To("/rewrite"),
+			},
+		},
+	}
+
+	urlRewriteFilterBadPath = HTTPRoute{
+		Name:     "rewrite",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("rewrite"),
+		},
+		URLRewrite: &URLRewrite{
+			Hostname: ptr.To("rewrite.example.com"),
+			Path: &HTTPPathModifier{
+				FullReplace:        ptr.To("/rewrite"),
+				PrefixMatchReplace: ptr.To("/rewrite"),
+			},
+		},
+	}
+
+	addRequestHeaderHTTPRoute = HTTPRoute{
+		Name:     "addheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("addheader"),
+		},
+		AddRequestHeaders: []AddHeader{
+			{
+				Name:   "example-header",
+				Value:  "example-value",
+				Append: true,
+			},
+			{
+				Name:   "example-header-2",
+				Value:  "example-value-2",
+				Append: false,
+			},
+			{
+				Name:   "empty-header",
+				Value:  "",
+				Append: false,
+			},
+		},
+	}
+
+	removeRequestHeaderHTTPRoute = HTTPRoute{
+		Name:     "remheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("remheader"),
+		},
+		RemoveRequestHeaders: []string{
+			"x-request-header",
+			"example-header",
+			"another-header",
+		},
+	}
+
+	addAndRemoveRequestHeadersDupeHTTPRoute = HTTPRoute{
+		Name:     "duplicateheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("duplicateheader"),
+		},
+		AddRequestHeaders: []AddHeader{
+			{
+				Name:   "example-header",
+				Value:  "example-value",
+				Append: true,
+			},
+			{
+				Name:   "example-header",
+				Value:  "example-value-2",
+				Append: false,
+			},
+		},
+		RemoveRequestHeaders: []string{
+			"x-request-header",
+			"example-header",
+			"example-header",
+		},
+	}
+
+	addRequestHeaderEmptyHTTPRoute = HTTPRoute{
+		Name:     "addemptyheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("addemptyheader"),
+		},
+		AddRequestHeaders: []AddHeader{
+			{
+				Name:   "",
+				Value:  "example-value",
+				Append: true,
+			},
+		},
+	}
+
+	addResponseHeaderHTTPRoute = HTTPRoute{
+		Name:     "addheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("addheader"),
+		},
+		AddResponseHeaders: []AddHeader{
+			{
+				Name:   "example-header",
+				Value:  "example-value",
+				Append: true,
+			},
+			{
+				Name:   "example-header-2",
+				Value:  "example-value-2",
+				Append: false,
+			},
+			{
+				Name:   "empty-header",
+				Value:  "",
+				Append: false,
+			},
+		},
+	}
+
+	removeResponseHeaderHTTPRoute = HTTPRoute{
+		Name:     "remheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("remheader"),
+		},
+		RemoveResponseHeaders: []string{
+			"x-request-header",
+			"example-header",
+			"another-header",
+		},
+	}
+
+	addAndRemoveResponseHeadersDupeHTTPRoute = HTTPRoute{
+		Name:     "duplicateheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("duplicateheader"),
+		},
+		AddResponseHeaders: []AddHeader{
+			{
+				Name:   "example-header",
+				Value:  "example-value",
+				Append: true,
+			},
+			{
+				Name:   "example-header",
+				Value:  "example-value-2",
+				Append: false,
+			},
+		},
+		RemoveResponseHeaders: []string{
+			"x-request-header",
+			"example-header",
+			"example-header",
+		},
+	}
+
+	addResponseHeaderEmptyHTTPRoute = HTTPRoute{
+		Name:     "addemptyheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("addemptyheader"),
+		},
+		AddResponseHeaders: []AddHeader{
+			{
+				Name:   "",
+				Value:  "example-value",
+				Append: true,
+			},
+		},
+	}
+
+	jwtAuthenHTTPRoute = HTTPRoute{
+		Name:     "jwtauthen",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("jwtauthen"),
+		},
+	}
+	requestMirrorFilter = HTTPRoute{
+		Name:     "mirrorfilter",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("mirrorfilter"),
+		},
+		Mirrors: []*RouteDestination{&happyRouteDestination},
+	}
+
+	// RouteDestination
+	happyRouteDestination = RouteDestination{
+		Name: "happy-dest",
+		Settings: []*DestinationSetting{
+			{
+				Endpoints: []*DestinationEndpoint{
+					{
+						Host: "10.11.12.13",
+						Port: 8080,
+					},
+				},
+			},
+		},
+	}
+)
+
+func TestValidateXds(t *testing.T) {
+	tests := []struct {
+		name  string
+		input Xds
+		want  []error
+	}{
+		{
+			name: "happy",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener},
+			},
+			want: nil,
+		},
+		{
+			name: "happy tls passthrough",
+			input: Xds{
+				TCP: []*TCPListener{&happyTCPListenerTLSPassthrough},
+			},
+			want: nil,
+		},
+		{
+			name: "happy tls terminate",
+			input: Xds{
+				TCP: []*TCPListener{&happyTCPListenerTLSTerminate},
+			},
+			want: nil,
+		},
+		{
+			name: "invalid listener",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener, &invalidAddrHTTPListener},
+			},
+			want: []error{ErrListenerAddressInvalid},
+		},
+		{
+			name: "invalid backend",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener, &invalidBackendHTTPListener},
+			},
+			want: nil,
+		},
+		{
+			name: "weighted invalid backend",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener, &weightedInvalidBackendsHTTPListener},
+			},
+			want: nil,
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				got := test.input.Validate()
+				for _, w := range test.want {
+					require.ErrorContains(t, got, w.Error())
+				}
+			}
+		})
+	}
+}
+
+func TestValidateHTTPListener(t *testing.T) {
+	tests := []struct {
+		name  string
+		input HTTPListener
+		want  []error
+	}{
+		{
+			name:  "happy",
+			input: happyHTTPListener,
+			want:  nil,
+		},
+		{
+			name: "invalid name",
+			input: HTTPListener{
+				Address:   "0.0.0.0",
+				Port:      80,
+				Hostnames: []string{"example.com"},
+				Routes:    []*HTTPRoute{&happyHTTPRoute},
+			},
+			want: []error{ErrListenerNameEmpty},
+		},
+		{
+			name:  "invalid addr",
+			input: invalidAddrHTTPListener,
+			want:  []error{ErrListenerAddressInvalid},
+		},
+		{
+			name: "invalid port and hostnames",
+			input: HTTPListener{
+				Name:    "invalid-port-and-hostnames",
+				Address: "1.0.0",
+				Routes:  []*HTTPRoute{&happyHTTPRoute},
+			},
+			want: []error{ErrListenerPortInvalid, ErrHTTPListenerHostnamesEmpty},
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				got := test.input.Validate()
+				for _, w := range test.want {
+					require.ErrorContains(t, got, w.Error())
+				}
+			}
+		})
+	}
+}
+
+func TestValidateTCPListener(t *testing.T) {
+	tests := []struct {
+		name  string
+		input TCPListener
+		want  []error
+	}{
+		{
+			name:  "tls passthrough happy",
+			input: happyTCPListenerTLSPassthrough,
+			want:  nil,
+		},
+		{
+			name:  "tcp empty SNIs",
+			input: emptySNITCPListenerTLSPassthrough,
+			want:  nil,
+		},
+		{
+			name:  "tls passthrough invalid name",
+			input: invalidNameTCPListenerTLSPassthrough,
+			want:  []error{ErrListenerNameEmpty},
+		},
+		{
+			name:  "tls passthrough invalid addr",
+			input: invalidAddrTCPListenerTLSPassthrough,
+			want:  []error{ErrListenerAddressInvalid},
+		},
+		{
+			name:  "tls passthrough empty SNIs",
+			input: invalidSNITCPListenerTLSPassthrough,
+			want:  []error{ErrTCPListenerSNIsEmpty},
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				got := test.input.Validate()
+				for _, w := range test.want {
+					require.ErrorContains(t, got, w.Error())
+				}
+			}
+		})
+	}
+}
+
+func TestValidateTLSListenerConfig(t *testing.T) {
+	tests := []struct {
+		name  string
+		input TLSConfig
+		want  error
+	}{
+		{
+			name: "happy",
+			input: TLSConfig{
+				Certificates: []TLSCertificate{{
+					ServerCertificate: []byte("server-cert"),
+					PrivateKey:        []byte("priv-key"),
+				}}},
+			want: nil,
+		},
+		{
+			name: "invalid server cert",
+			input: TLSConfig{
+				Certificates: []TLSCertificate{{
+					PrivateKey: []byte("priv-key"),
+				}}},
+			want: ErrTLSServerCertEmpty,
+		},
+		{
+			name: "invalid private key",
+			input: TLSConfig{
+				Certificates: []TLSCertificate{{
+					ServerCertificate: []byte("server-cert"),
+				}}},
+			want: ErrTLSPrivateKey,
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				require.EqualError(t, test.input.Validate(), test.want.Error())
+			}
+		})
+	}
+}
+
+func TestEqualXds(t *testing.T) {
+	tests := []struct {
+		desc  string
+		a     *Xds
+		b     *Xds
+		equal bool
+	}{
+		{
+			desc: "out of order http routes are equal",
+			a: &Xds{
+				HTTP: []*HTTPListener{
+					{
+						Name: "listener-1",
+						Routes: []*HTTPRoute{
+							{Name: "route-1"},
+							{Name: "route-2"},
+						},
+					},
+				},
+			},
+			b: &Xds{
+				HTTP: []*HTTPListener{
+					{
+						Name: "listener-1",
+						Routes: []*HTTPRoute{
+							{Name: "route-2"},
+							{Name: "route-1"},
+						},
+					},
+				},
+			},
+			equal: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.desc, func(t *testing.T) {
+			require.Equal(t, tc.equal, cmp.Equal(tc.a, tc.b))
+		})
+	}
+}
+
+func TestValidateUDPListener(t *testing.T) {
+	tests := []struct {
+		name  string
+		input UDPListener
+		want  []error
+	}{
+		{
+			name:  "udp happy",
+			input: happyUDPListener,
+			want:  nil,
+		},
+		{
+			name:  "udp invalid name",
+			input: invalidNameUDPListener,
+			want:  []error{ErrListenerNameEmpty},
+		},
+		{
+			name:  "udp invalid addr",
+			input: invalidAddrUDPListener,
+			want:  []error{ErrListenerAddressInvalid},
+		},
+		{
+			name:  "udp invalid port",
+			input: invalidPortUDPListenerT,
+			want:  []error{ErrListenerPortInvalid},
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				got := test.input.Validate()
+				for _, w := range test.want {
+					require.ErrorContains(t, got, w.Error())
+				}
+			}
+		})
+	}
+}
+
+func TestValidateHTTPRoute(t *testing.T) {
+	tests := []struct {
+		name  string
+		input HTTPRoute
+		want  []error
+	}{
+		{
+			name:  "happy",
+			input: happyHTTPRoute,
+			want:  nil,
+		},
+		{
+			name: "invalid name",
+			input: HTTPRoute{
+				Hostname: "*",
+				PathMatch: &StringMatch{
+					Exact: ptr.To("example"),
+				},
+				Destination: &happyRouteDestination,
+			},
+			want: []error{ErrHTTPRouteNameEmpty},
+		},
+		{
+			name: "invalid hostname",
+			input: HTTPRoute{
+				Name: "invalid hostname",
+				PathMatch: &StringMatch{
+					Exact: ptr.To("example"),
+				},
+				Destination: &happyRouteDestination,
+			},
+			want: []error{ErrHTTPRouteHostnameEmpty},
+		},
+		{
+			name:  "invalid backend",
+			input: invalidBackendHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "weighted invalid backends",
+			input: weightedInvalidBackendsHTTPRoute,
+			want:  nil,
+		},
+		{
+			name: "empty name and invalid match",
+			input: HTTPRoute{
+				Hostname:      "*",
+				HeaderMatches: []*StringMatch{ptr.To(StringMatch{})},
+				Destination:   &happyRouteDestination,
+			},
+			want: []error{ErrHTTPRouteNameEmpty, ErrStringMatchConditionInvalid},
+		},
+		{
+			name:  "redirect-httproute",
+			input: redirectHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "filter-error-httproute",
+			input: invalidFilterHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "redirect-bad-status-scheme-nopath",
+			input: redirectFilterInvalidStatus,
+			want:  []error{ErrRedirectUnsupportedStatus, ErrRedirectUnsupportedScheme, ErrHTTPPathModifierNoReplace},
+		},
+		{
+			name:  "redirect-bad-path",
+			input: redirectFilterBadPath,
+			want:  []error{ErrHTTPPathModifierDoubleReplace},
+		},
+		{
+			name:  "direct-response-bad-status",
+			input: directResponseBadStatus,
+			want:  []error{ErrDirectResponseStatusInvalid},
+		},
+		{
+			name:  "rewrite-httproute",
+			input: urlRewriteHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "rewrite-bad-path",
+			input: urlRewriteFilterBadPath,
+			want:  []error{ErrHTTPPathModifierDoubleReplace},
+		},
+		{
+			name:  "add-request-headers-httproute",
+			input: addRequestHeaderHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "remove-request-headers-httproute",
+			input: removeRequestHeaderHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "add-remove-request-headers-duplicate",
+			input: addAndRemoveRequestHeadersDupeHTTPRoute,
+			want:  []error{ErrAddHeaderDuplicate, ErrRemoveHeaderDuplicate},
+		},
+		{
+			name:  "add-request-header-empty",
+			input: addRequestHeaderEmptyHTTPRoute,
+			want:  []error{ErrAddHeaderEmptyName},
+		},
+		{
+			name:  "add-response-headers-httproute",
+			input: addResponseHeaderHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "remove-response-headers-httproute",
+			input: removeResponseHeaderHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "add-remove-response-headers-duplicate",
+			input: addAndRemoveResponseHeadersDupeHTTPRoute,
+			want:  []error{ErrAddHeaderDuplicate, ErrRemoveHeaderDuplicate},
+		},
+		{
+			name:  "add-response-header-empty",
+			input: addResponseHeaderEmptyHTTPRoute,
+			want:  []error{ErrAddHeaderEmptyName},
+		},
+		{
+			name:  "jwt-authen-httproute",
+			input: jwtAuthenHTTPRoute,
+		},
+		{
+			name:  "mirror-filter",
+			input: requestMirrorFilter,
+			want:  nil,
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				got := test.input.Validate()
+				for _, w := range test.want {
+					require.ErrorContains(t, got, w.Error())
+				}
+			}
+		})
+	}
+}
+
+func TestValidateRouteDestination(t *testing.T) {
+	tests := []struct {
+		name  string
+		input RouteDestination
+		want  error
+	}{
+		{
+			name:  "happy",
+			input: happyRouteDestination,
+			want:  nil,
+		},
+		{
+			name: "valid hostname",
+			input: RouteDestination{
+				Name: "valid hostname",
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "example.com",
+								Port: 8080,
+							},
+						},
+					},
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "valid ip",
+			input: RouteDestination{
+				Name: "valid ip",
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "1.2.3.4",
+								Port: 8080,
+							},
+						},
+					},
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "invalid address",
+			input: RouteDestination{
+				Name: "invalid address",
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "example.com::foo.bar",
+								Port: 8080,
+							},
+						},
+					},
+				},
+			},
+			want: ErrDestEndpointHostInvalid,
+		},
+		{
+			name: "missing ip",
+			input: RouteDestination{
+				Name: "missing ip",
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Port: 8080,
+							},
+						},
+					},
+				},
+			},
+			want: ErrDestEndpointHostInvalid,
+		},
+		{
+			name: "missing port",
+			input: RouteDestination{
+				Name: "missing port",
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "10.11.12.13",
+							},
+						},
+					},
+				},
+			},
+			want: ErrDestEndpointPortInvalid,
+		},
+		{
+			name: "missing name",
+			input: RouteDestination{
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "10.11.12.13",
+								Port: 8080,
+							},
+						},
+					},
+				},
+			},
+			want: ErrDestinationNameEmpty,
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				require.EqualError(t, test.input.Validate(), test.want.Error())
+			}
+		})
+	}
+}
+
+func TestValidateStringMatch(t *testing.T) {
+	tests := []struct {
+		name  string
+		input StringMatch
+		want  error
+	}{
+		{
+			name: "happy",
+			input: StringMatch{
+				Exact: ptr.To("example"),
+			},
+			want: nil,
+		},
+		{
+			name:  "no fields set",
+			input: StringMatch{},
+			want:  ErrStringMatchConditionInvalid,
+		},
+		{
+			name: "multiple fields set",
+			input: StringMatch{
+				Exact:  ptr.To("example"),
+				Name:   "example",
+				Prefix: ptr.To("example"),
+			},
+			want: ErrStringMatchConditionInvalid,
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				require.EqualError(t, test.input.Validate(), test.want.Error())
+			}
+		})
+	}
+}
+
+func TestValidateLoadBalancer(t *testing.T) {
+	tests := []struct {
+		name  string
+		input LoadBalancer
+		want  error
+	}{
+		{
+			name: "random",
+			input: LoadBalancer{
+				Random: &Random{},
+			},
+			want: nil,
+		},
+		{
+			name: "consistent hash",
+			input: LoadBalancer{
+				ConsistentHash: &ConsistentHash{
+					SourceIP: ptr.To(true),
+				},
+			},
+			want: nil,
+		},
+
+		{
+			name: "least request and random set",
+			input: LoadBalancer{
+				Random:       &Random{},
+				LeastRequest: &LeastRequest{},
+			},
+			want: ErrLoadBalancerInvalid,
+		},
+	}
+	for i := range tests {
+		test := tests[i]
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				require.EqualError(t, test.input.Validate(), test.want.Error())
+			}
+		})
+	}
+}
+
+func TestPrintable(t *testing.T) {
+	tests := []struct {
+		name  string
+		input Xds
+		want  *Xds
+	}{
+		{
+			name:  "empty",
+			input: Xds{},
+			want:  &Xds{},
+		},
+		{
+			name: "http",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener},
+			},
+			want: &Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener},
+			},
+		},
+		{
+			name: "https",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPSListener},
+			},
+			want: &Xds{
+				HTTP: []*HTTPListener{&redactedHappyHTTPSListener},
+			},
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, *test.want, *test.input.Printable())
+		})
+	}
+}
+
+func TestValidateHealthCheck(t *testing.T) {
+	tests := []struct {
+		name  string
+		input HealthCheck
+		want  error
+	}{
+		{
+			name: "invalid timeout",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Duration(0)},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To[uint32](3),
+				HealthyThreshold:   ptr.To[uint32](3),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckTimeoutInvalid,
+		},
+		{
+			name: "invalid interval",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Duration(0)},
+				UnhealthyThreshold: ptr.To[uint32](3),
+				HealthyThreshold:   ptr.To[uint32](3),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodGet),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckIntervalInvalid,
+		},
+		{
+			name: "invalid unhealthy threshold",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To[uint32](0),
+				HealthyThreshold:   ptr.To[uint32](3),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodPatch),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckUnhealthyThresholdInvalid,
+		},
+		{
+			name: "invalid healthy threshold",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To[uint32](3),
+				HealthyThreshold:   ptr.To[uint32](0),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodPost),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckHealthyThresholdInvalid,
+		},
+		{
+			name: "http-health-check: invalid host",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To[uint32](3),
+				HealthyThreshold:   ptr.To[uint32](3),
+				HTTP: &HTTPHealthChecker{
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodPut),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHCHTTPHostInvalid,
+		},
+		{
+			name: "http-health-check: invalid path",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To[uint32](3),
+				HealthyThreshold:   ptr.To[uint32](3),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "",
+					Method:           ptr.To(http.MethodPut),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHCHTTPPathInvalid,
+		},
+		{
+			name: "http-health-check: invalid method",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodConnect),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHCHTTPMethodInvalid,
+		},
+		{
+			name: "http-health-check: invalid expected-statuses",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodDelete),
+					ExpectedStatuses: []HTTPStatus{},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHCHTTPExpectedStatusesInvalid,
+		},
+		{
+			name: "http-health-check: invalid range",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodHead),
+					ExpectedStatuses: []HTTPStatus{100, 600},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHTTPStatusInvalid,
+		},
+		{
+			name: "http-health-check: invalid expected-responses",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodOptions),
+					ExpectedStatuses: []HTTPStatus{200, 300},
+					ExpectedResponse: &HealthCheckPayload{
+						Text:   ptr.To("foo"),
+						Binary: []byte{'f', 'o', 'o'},
+					},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckPayloadInvalid,
+		},
+		{
+			name: "tcp-health-check: invalid send payload",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				TCP: &TCPHealthChecker{
+					Send: &HealthCheckPayload{
+						Text:   ptr.To("foo"),
+						Binary: []byte{'f', 'o', 'o'},
+					},
+					Receive: &HealthCheckPayload{
+						Text: ptr.To("foo"),
+					},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckPayloadInvalid,
+		},
+		{
+			name: "tcp-health-check: invalid receive payload",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				TCP: &TCPHealthChecker{
+					Send: &HealthCheckPayload{
+						Text: ptr.To("foo"),
+					},
+					Receive: &HealthCheckPayload{
+						Text:   ptr.To("foo"),
+						Binary: []byte{'f', 'o', 'o'},
+					},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckPayloadInvalid,
+		},
+		{
+			name: "OutlierDetection invalid interval",
+			input: HealthCheck{&ActiveHealthCheck{},
+				&OutlierDetection{
+					Interval:         &metav1.Duration{Duration: time.Duration(0)},
+					BaseEjectionTime: &metav1.Duration{Duration: time.Second},
+				},
+			},
+			want: ErrOutlierDetectionIntervalInvalid,
+		},
+		{
+			name: "OutlierDetection invalid BaseEjectionTime",
+			input: HealthCheck{&ActiveHealthCheck{},
+				&OutlierDetection{
+					Interval:         &metav1.Duration{Duration: time.Second},
+					BaseEjectionTime: &metav1.Duration{Duration: time.Duration(0)},
+				},
+			},
+			want: ErrOutlierDetectionBaseEjectionTimeInvalid,
+		},
+	}
+	for i := range tests {
+		test := tests[i]
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				require.EqualError(t, test.input.Validate(), test.want.Error())
+			}
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go b/adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go
new file mode 100644
index 000000000..05c2e8eee
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go
@@ -0,0 +1,2221 @@
+//go:build !ignore_autogenerated
+
+/*
+ *  Copyright (c) 2023, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package ir
+
+import (
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AccessLog) DeepCopyInto(out *AccessLog) {
+	*out = *in
+	if in.Text != nil {
+		in, out := &in.Text, &out.Text
+		*out = make([]*TextAccessLog, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(TextAccessLog)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.JSON != nil {
+		in, out := &in.JSON, &out.JSON
+		*out = make([]*JSONAccessLog, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(JSONAccessLog)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.OpenTelemetry != nil {
+		in, out := &in.OpenTelemetry, &out.OpenTelemetry
+		*out = make([]*OpenTelemetryAccessLog, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(OpenTelemetryAccessLog)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AccessLog.
+func (in *AccessLog) DeepCopy() *AccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(AccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ActiveHealthCheck) DeepCopyInto(out *ActiveHealthCheck) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.UnhealthyThreshold != nil {
+		in, out := &in.UnhealthyThreshold, &out.UnhealthyThreshold
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.HealthyThreshold != nil {
+		in, out := &in.HealthyThreshold, &out.HealthyThreshold
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPHealthChecker)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TCP != nil {
+		in, out := &in.TCP, &out.TCP
+		*out = new(TCPHealthChecker)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ActiveHealthCheck.
+func (in *ActiveHealthCheck) DeepCopy() *ActiveHealthCheck {
+	if in == nil {
+		return nil
+	}
+	out := new(ActiveHealthCheck)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AddHeader) DeepCopyInto(out *AddHeader) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AddHeader.
+func (in *AddHeader) DeepCopy() *AddHeader {
+	if in == nil {
+		return nil
+	}
+	out := new(AddHeader)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackOffPolicy) DeepCopyInto(out *BackOffPolicy) {
+	*out = *in
+	if in.BaseInterval != nil {
+		in, out := &in.BaseInterval, &out.BaseInterval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.MaxInterval != nil {
+		in, out := &in.MaxInterval, &out.MaxInterval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackOffPolicy.
+func (in *BackOffPolicy) DeepCopy() *BackOffPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(BackOffPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackendWeights) DeepCopyInto(out *BackendWeights) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendWeights.
+func (in *BackendWeights) DeepCopy() *BackendWeights {
+	if in == nil {
+		return nil
+	}
+	out := new(BackendWeights)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BasicAuth) DeepCopyInto(out *BasicAuth) {
+	*out = *in
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BasicAuth.
+func (in *BasicAuth) DeepCopy() *BasicAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(BasicAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CORS) DeepCopyInto(out *CORS) {
+	*out = *in
+	if in.AllowOrigins != nil {
+		in, out := &in.AllowOrigins, &out.AllowOrigins
+		*out = make([]*StringMatch, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StringMatch)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.AllowMethods != nil {
+		in, out := &in.AllowMethods, &out.AllowMethods
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.AllowHeaders != nil {
+		in, out := &in.AllowHeaders, &out.AllowHeaders
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ExposeHeaders != nil {
+		in, out := &in.ExposeHeaders, &out.ExposeHeaders
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.MaxAge != nil {
+		in, out := &in.MaxAge, &out.MaxAge
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CORS.
+func (in *CORS) DeepCopy() *CORS {
+	if in == nil {
+		return nil
+	}
+	out := new(CORS)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CircuitBreaker) DeepCopyInto(out *CircuitBreaker) {
+	*out = *in
+	if in.MaxConnections != nil {
+		in, out := &in.MaxConnections, &out.MaxConnections
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxPendingRequests != nil {
+		in, out := &in.MaxPendingRequests, &out.MaxPendingRequests
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxParallelRequests != nil {
+		in, out := &in.MaxParallelRequests, &out.MaxParallelRequests
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxRequestsPerConnection != nil {
+		in, out := &in.MaxRequestsPerConnection, &out.MaxRequestsPerConnection
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxParallelRetries != nil {
+		in, out := &in.MaxParallelRetries, &out.MaxParallelRetries
+		*out = new(uint32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CircuitBreaker.
+func (in *CircuitBreaker) DeepCopy() *CircuitBreaker {
+	if in == nil {
+		return nil
+	}
+	out := new(CircuitBreaker)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClientTimeout) DeepCopyInto(out *ClientTimeout) {
+	*out = *in
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPClientTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientTimeout.
+func (in *ClientTimeout) DeepCopy() *ClientTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(ClientTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConsistentHash) DeepCopyInto(out *ConsistentHash) {
+	*out = *in
+	if in.SourceIP != nil {
+		in, out := &in.SourceIP, &out.SourceIP
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConsistentHash.
+func (in *ConsistentHash) DeepCopy() *ConsistentHash {
+	if in == nil {
+		return nil
+	}
+	out := new(ConsistentHash)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DestinationEndpoint) DeepCopyInto(out *DestinationEndpoint) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DestinationEndpoint.
+func (in *DestinationEndpoint) DeepCopy() *DestinationEndpoint {
+	if in == nil {
+		return nil
+	}
+	out := new(DestinationEndpoint)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DestinationSetting) DeepCopyInto(out *DestinationSetting) {
+	*out = *in
+	if in.Weight != nil {
+		in, out := &in.Weight, &out.Weight
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.Endpoints != nil {
+		in, out := &in.Endpoints, &out.Endpoints
+		*out = make([]*DestinationEndpoint, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(DestinationEndpoint)
+				**out = **in
+			}
+		}
+	}
+	if in.AddressType != nil {
+		in, out := &in.AddressType, &out.AddressType
+		*out = new(DestinationAddressType)
+		**out = **in
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSUpstreamConfig)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DestinationSetting.
+func (in *DestinationSetting) DeepCopy() *DestinationSetting {
+	if in == nil {
+		return nil
+	}
+	out := new(DestinationSetting)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DirectResponse) DeepCopyInto(out *DirectResponse) {
+	*out = *in
+	if in.Body != nil {
+		in, out := &in.Body, &out.Body
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DirectResponse.
+func (in *DirectResponse) DeepCopy() *DirectResponse {
+	if in == nil {
+		return nil
+	}
+	out := new(DirectResponse)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExtAuth) DeepCopyInto(out *ExtAuth) {
+	*out = *in
+	if in.GRPC != nil {
+		in, out := &in.GRPC, &out.GRPC
+		*out = new(GRPCExtAuthService)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPExtAuthService)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HeadersToExtAuth != nil {
+		in, out := &in.HeadersToExtAuth, &out.HeadersToExtAuth
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtAuth.
+func (in *ExtAuth) DeepCopy() *ExtAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(ExtAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FaultInjection) DeepCopyInto(out *FaultInjection) {
+	*out = *in
+	if in.Delay != nil {
+		in, out := &in.Delay, &out.Delay
+		*out = new(FaultInjectionDelay)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Abort != nil {
+		in, out := &in.Abort, &out.Abort
+		*out = new(FaultInjectionAbort)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FaultInjection.
+func (in *FaultInjection) DeepCopy() *FaultInjection {
+	if in == nil {
+		return nil
+	}
+	out := new(FaultInjection)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FaultInjectionAbort) DeepCopyInto(out *FaultInjectionAbort) {
+	*out = *in
+	if in.HTTPStatus != nil {
+		in, out := &in.HTTPStatus, &out.HTTPStatus
+		*out = new(int32)
+		**out = **in
+	}
+	if in.GrpcStatus != nil {
+		in, out := &in.GrpcStatus, &out.GrpcStatus
+		*out = new(int32)
+		**out = **in
+	}
+	if in.Percentage != nil {
+		in, out := &in.Percentage, &out.Percentage
+		*out = new(float32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FaultInjectionAbort.
+func (in *FaultInjectionAbort) DeepCopy() *FaultInjectionAbort {
+	if in == nil {
+		return nil
+	}
+	out := new(FaultInjectionAbort)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FaultInjectionDelay) DeepCopyInto(out *FaultInjectionDelay) {
+	*out = *in
+	if in.FixedDelay != nil {
+		in, out := &in.FixedDelay, &out.FixedDelay
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.Percentage != nil {
+		in, out := &in.Percentage, &out.Percentage
+		*out = new(float32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FaultInjectionDelay.
+func (in *FaultInjectionDelay) DeepCopy() *FaultInjectionDelay {
+	if in == nil {
+		return nil
+	}
+	out := new(FaultInjectionDelay)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GRPCExtAuthService) DeepCopyInto(out *GRPCExtAuthService) {
+	*out = *in
+	in.Destination.DeepCopyInto(&out.Destination)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GRPCExtAuthService.
+func (in *GRPCExtAuthService) DeepCopy() *GRPCExtAuthService {
+	if in == nil {
+		return nil
+	}
+	out := new(GRPCExtAuthService)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GlobalRateLimit) DeepCopyInto(out *GlobalRateLimit) {
+	*out = *in
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]*RateLimitRule, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(RateLimitRule)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalRateLimit.
+func (in *GlobalRateLimit) DeepCopy() *GlobalRateLimit {
+	if in == nil {
+		return nil
+	}
+	out := new(GlobalRateLimit)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTP10Settings) DeepCopyInto(out *HTTP10Settings) {
+	*out = *in
+	if in.DefaultHost != nil {
+		in, out := &in.DefaultHost, &out.DefaultHost
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTP10Settings.
+func (in *HTTP10Settings) DeepCopy() *HTTP10Settings {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTP10Settings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTP1Settings) DeepCopyInto(out *HTTP1Settings) {
+	*out = *in
+	if in.HTTP10 != nil {
+		in, out := &in.HTTP10, &out.HTTP10
+		*out = new(HTTP10Settings)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTP1Settings.
+func (in *HTTP1Settings) DeepCopy() *HTTP1Settings {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTP1Settings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) {
+	*out = *in
+	if in.RequestReceivedTimeout != nil {
+		in, out := &in.RequestReceivedTimeout, &out.RequestReceivedTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPClientTimeout.
+func (in *HTTPClientTimeout) DeepCopy() *HTTPClientTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPClientTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPExtAuthService) DeepCopyInto(out *HTTPExtAuthService) {
+	*out = *in
+	in.Destination.DeepCopyInto(&out.Destination)
+	if in.HeadersToBackend != nil {
+		in, out := &in.HeadersToBackend, &out.HeadersToBackend
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPExtAuthService.
+func (in *HTTPExtAuthService) DeepCopy() *HTTPExtAuthService {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPExtAuthService)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPHealthChecker) DeepCopyInto(out *HTTPHealthChecker) {
+	*out = *in
+	if in.Method != nil {
+		in, out := &in.Method, &out.Method
+		*out = new(string)
+		**out = **in
+	}
+	if in.ExpectedStatuses != nil {
+		in, out := &in.ExpectedStatuses, &out.ExpectedStatuses
+		*out = make([]HTTPStatus, len(*in))
+		copy(*out, *in)
+	}
+	if in.ExpectedResponse != nil {
+		in, out := &in.ExpectedResponse, &out.ExpectedResponse
+		*out = new(HealthCheckPayload)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPHealthChecker.
+func (in *HTTPHealthChecker) DeepCopy() *HTTPHealthChecker {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPHealthChecker)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPListener) DeepCopyInto(out *HTTPListener) {
+	*out = *in
+	if in.Hostnames != nil {
+		in, out := &in.Hostnames, &out.Hostnames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSConfig)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Routes != nil {
+		in, out := &in.Routes, &out.Routes
+		*out = make([]*HTTPRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(HTTPRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.TCPKeepalive != nil {
+		in, out := &in.TCPKeepalive, &out.TCPKeepalive
+		*out = new(TCPKeepalive)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = new(HeaderSettings)
+		**out = **in
+	}
+	if in.HTTP3 != nil {
+		in, out := &in.HTTP3, &out.HTTP3
+		*out = new(HTTP3Settings)
+		**out = **in
+	}
+	out.Path = in.Path
+	if in.HTTP1 != nil {
+		in, out := &in.HTTP1, &out.HTTP1
+		*out = new(HTTP1Settings)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(ClientTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPListener.
+func (in *HTTPListener) DeepCopy() *HTTPListener {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPListener)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPPathModifier) DeepCopyInto(out *HTTPPathModifier) {
+	*out = *in
+	if in.FullReplace != nil {
+		in, out := &in.FullReplace, &out.FullReplace
+		*out = new(string)
+		**out = **in
+	}
+	if in.PrefixMatchReplace != nil {
+		in, out := &in.PrefixMatchReplace, &out.PrefixMatchReplace
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPPathModifier.
+func (in *HTTPPathModifier) DeepCopy() *HTTPPathModifier {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPPathModifier)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPRoute) DeepCopyInto(out *HTTPRoute) {
+	*out = *in
+	if in.PathMatch != nil {
+		in, out := &in.PathMatch, &out.PathMatch
+		*out = new(StringMatch)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HeaderMatches != nil {
+		in, out := &in.HeaderMatches, &out.HeaderMatches
+		*out = make([]*StringMatch, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StringMatch)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.QueryParamMatches != nil {
+		in, out := &in.QueryParamMatches, &out.QueryParamMatches
+		*out = make([]*StringMatch, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StringMatch)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	out.BackendWeights = in.BackendWeights
+	if in.AddRequestHeaders != nil {
+		in, out := &in.AddRequestHeaders, &out.AddRequestHeaders
+		*out = make([]AddHeader, len(*in))
+		copy(*out, *in)
+	}
+	if in.RemoveRequestHeaders != nil {
+		in, out := &in.RemoveRequestHeaders, &out.RemoveRequestHeaders
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.AddResponseHeaders != nil {
+		in, out := &in.AddResponseHeaders, &out.AddResponseHeaders
+		*out = make([]AddHeader, len(*in))
+		copy(*out, *in)
+	}
+	if in.RemoveResponseHeaders != nil {
+		in, out := &in.RemoveResponseHeaders, &out.RemoveResponseHeaders
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.DirectResponse != nil {
+		in, out := &in.DirectResponse, &out.DirectResponse
+		*out = new(DirectResponse)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Redirect != nil {
+		in, out := &in.Redirect, &out.Redirect
+		*out = new(Redirect)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Mirrors != nil {
+		in, out := &in.Mirrors, &out.Mirrors
+		*out = make([]*RouteDestination, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(RouteDestination)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Destination != nil {
+		in, out := &in.Destination, &out.Destination
+		*out = new(RouteDestination)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.URLRewrite != nil {
+		in, out := &in.URLRewrite, &out.URLRewrite
+		*out = new(URLRewrite)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.RateLimit != nil {
+		in, out := &in.RateLimit, &out.RateLimit
+		*out = new(RateLimit)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.LoadBalancer != nil {
+		in, out := &in.LoadBalancer, &out.LoadBalancer
+		*out = new(LoadBalancer)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.CORS != nil {
+		in, out := &in.CORS, &out.CORS
+		*out = new(CORS)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.OIDC != nil {
+		in, out := &in.OIDC, &out.OIDC
+		*out = new(OIDC)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ProxyProtocol != nil {
+		in, out := &in.ProxyProtocol, &out.ProxyProtocol
+		*out = new(ProxyProtocol)
+		**out = **in
+	}
+	if in.BasicAuth != nil {
+		in, out := &in.BasicAuth, &out.BasicAuth
+		*out = new(BasicAuth)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ExtAuth != nil {
+		in, out := &in.ExtAuth, &out.ExtAuth
+		*out = new(ExtAuth)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HealthCheck != nil {
+		in, out := &in.HealthCheck, &out.HealthCheck
+		*out = new(HealthCheck)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.FaultInjection != nil {
+		in, out := &in.FaultInjection, &out.FaultInjection
+		*out = new(FaultInjection)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ExtensionRefs != nil {
+		in, out := &in.ExtensionRefs, &out.ExtensionRefs
+		*out = make([]*UnstructuredRef, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(UnstructuredRef)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.CircuitBreaker != nil {
+		in, out := &in.CircuitBreaker, &out.CircuitBreaker
+		*out = new(CircuitBreaker)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(Timeout)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TCPKeepalive != nil {
+		in, out := &in.TCPKeepalive, &out.TCPKeepalive
+		*out = new(TCPKeepalive)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Retry != nil {
+		in, out := &in.Retry, &out.Retry
+		*out = new(Retry)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPRoute.
+func (in *HTTPRoute) DeepCopy() *HTTPRoute {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPRoute)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPTimeout) DeepCopyInto(out *HTTPTimeout) {
+	*out = *in
+	if in.RequestTimeout != nil {
+		in, out := &in.RequestTimeout, &out.RequestTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.ConnectionIdleTimeout != nil {
+		in, out := &in.ConnectionIdleTimeout, &out.ConnectionIdleTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.MaxConnectionDuration != nil {
+		in, out := &in.MaxConnectionDuration, &out.MaxConnectionDuration
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPTimeout.
+func (in *HTTPTimeout) DeepCopy() *HTTPTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HeaderSettings) DeepCopyInto(out *HeaderSettings) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HeaderSettings.
+func (in *HeaderSettings) DeepCopy() *HeaderSettings {
+	if in == nil {
+		return nil
+	}
+	out := new(HeaderSettings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HealthCheck) DeepCopyInto(out *HealthCheck) {
+	*out = *in
+	if in.Active != nil {
+		in, out := &in.Active, &out.Active
+		*out = new(ActiveHealthCheck)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Passive != nil {
+		in, out := &in.Passive, &out.Passive
+		*out = new(OutlierDetection)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HealthCheck.
+func (in *HealthCheck) DeepCopy() *HealthCheck {
+	if in == nil {
+		return nil
+	}
+	out := new(HealthCheck)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HealthCheckPayload) DeepCopyInto(out *HealthCheckPayload) {
+	*out = *in
+	if in.Text != nil {
+		in, out := &in.Text, &out.Text
+		*out = new(string)
+		**out = **in
+	}
+	if in.Binary != nil {
+		in, out := &in.Binary, &out.Binary
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HealthCheckPayload.
+func (in *HealthCheckPayload) DeepCopy() *HealthCheckPayload {
+	if in == nil {
+		return nil
+	}
+	out := new(HealthCheckPayload)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Infra) DeepCopyInto(out *Infra) {
+	*out = *in
+	if in.Proxy != nil {
+		in, out := &in.Proxy, &out.Proxy
+		*out = new(ProxyInfra)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Infra.
+func (in *Infra) DeepCopy() *Infra {
+	if in == nil {
+		return nil
+	}
+	out := new(Infra)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InfraMetadata) DeepCopyInto(out *InfraMetadata) {
+	*out = *in
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InfraMetadata.
+func (in *InfraMetadata) DeepCopy() *InfraMetadata {
+	if in == nil {
+		return nil
+	}
+	out := new(InfraMetadata)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JSONAccessLog) DeepCopyInto(out *JSONAccessLog) {
+	*out = *in
+	if in.JSON != nil {
+		in, out := &in.JSON, &out.JSON
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JSONAccessLog.
+func (in *JSONAccessLog) DeepCopy() *JSONAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(JSONAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JSONPatchConfig) DeepCopyInto(out *JSONPatchConfig) {
+	*out = *in
+	in.Operation.DeepCopyInto(&out.Operation)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JSONPatchConfig.
+func (in *JSONPatchConfig) DeepCopy() *JSONPatchConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(JSONPatchConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JSONPatchOperation) DeepCopyInto(out *JSONPatchOperation) {
+	*out = *in
+	if in.From != nil {
+		in, out := &in.From, &out.From
+		*out = new(string)
+		**out = **in
+	}
+	if in.Value != nil {
+		in, out := &in.Value, &out.Value
+		*out = new(apiextensionsv1.JSON)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JSONPatchOperation.
+func (in *JSONPatchOperation) DeepCopy() *JSONPatchOperation {
+	if in == nil {
+		return nil
+	}
+	out := new(JSONPatchOperation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LeastRequest) DeepCopyInto(out *LeastRequest) {
+	*out = *in
+	if in.SlowStart != nil {
+		in, out := &in.SlowStart, &out.SlowStart
+		*out = new(SlowStart)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LeastRequest.
+func (in *LeastRequest) DeepCopy() *LeastRequest {
+	if in == nil {
+		return nil
+	}
+	out := new(LeastRequest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenerPort) DeepCopyInto(out *ListenerPort) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenerPort.
+func (in *ListenerPort) DeepCopy() *ListenerPort {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenerPort)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LoadBalancer) DeepCopyInto(out *LoadBalancer) {
+	*out = *in
+	if in.RoundRobin != nil {
+		in, out := &in.RoundRobin, &out.RoundRobin
+		*out = new(RoundRobin)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.LeastRequest != nil {
+		in, out := &in.LeastRequest, &out.LeastRequest
+		*out = new(LeastRequest)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Random != nil {
+		in, out := &in.Random, &out.Random
+		*out = new(Random)
+		**out = **in
+	}
+	if in.ConsistentHash != nil {
+		in, out := &in.ConsistentHash, &out.ConsistentHash
+		*out = new(ConsistentHash)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LoadBalancer.
+func (in *LoadBalancer) DeepCopy() *LoadBalancer {
+	if in == nil {
+		return nil
+	}
+	out := new(LoadBalancer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LocalRateLimit) DeepCopyInto(out *LocalRateLimit) {
+	*out = *in
+	out.Default = in.Default
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]*RateLimitRule, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(RateLimitRule)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimit.
+func (in *LocalRateLimit) DeepCopy() *LocalRateLimit {
+	if in == nil {
+		return nil
+	}
+	out := new(LocalRateLimit)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Metrics) DeepCopyInto(out *Metrics) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Metrics.
+func (in *Metrics) DeepCopy() *Metrics {
+	if in == nil {
+		return nil
+	}
+	out := new(Metrics)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OIDC) DeepCopyInto(out *OIDC) {
+	*out = *in
+	out.Provider = in.Provider
+	if in.ClientSecret != nil {
+		in, out := &in.ClientSecret, &out.ClientSecret
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.HMACSecret != nil {
+		in, out := &in.HMACSecret, &out.HMACSecret
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.Scopes != nil {
+		in, out := &in.Scopes, &out.Scopes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDC.
+func (in *OIDC) DeepCopy() *OIDC {
+	if in == nil {
+		return nil
+	}
+	out := new(OIDC)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OpenTelemetryAccessLog) DeepCopyInto(out *OpenTelemetryAccessLog) {
+	*out = *in
+	if in.Text != nil {
+		in, out := &in.Text, &out.Text
+		*out = new(string)
+		**out = **in
+	}
+	if in.Attributes != nil {
+		in, out := &in.Attributes, &out.Attributes
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Resources != nil {
+		in, out := &in.Resources, &out.Resources
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenTelemetryAccessLog.
+func (in *OpenTelemetryAccessLog) DeepCopy() *OpenTelemetryAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(OpenTelemetryAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OutlierDetection) DeepCopyInto(out *OutlierDetection) {
+	*out = *in
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.SplitExternalLocalOriginErrors != nil {
+		in, out := &in.SplitExternalLocalOriginErrors, &out.SplitExternalLocalOriginErrors
+		*out = new(bool)
+		**out = **in
+	}
+	if in.ConsecutiveLocalOriginFailures != nil {
+		in, out := &in.ConsecutiveLocalOriginFailures, &out.ConsecutiveLocalOriginFailures
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.ConsecutiveGatewayErrors != nil {
+		in, out := &in.ConsecutiveGatewayErrors, &out.ConsecutiveGatewayErrors
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.Consecutive5xxErrors != nil {
+		in, out := &in.Consecutive5xxErrors, &out.Consecutive5xxErrors
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.BaseEjectionTime != nil {
+		in, out := &in.BaseEjectionTime, &out.BaseEjectionTime
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.MaxEjectionPercent != nil {
+		in, out := &in.MaxEjectionPercent, &out.MaxEjectionPercent
+		*out = new(int32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OutlierDetection.
+func (in *OutlierDetection) DeepCopy() *OutlierDetection {
+	if in == nil {
+		return nil
+	}
+	out := new(OutlierDetection)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PathSettings) DeepCopyInto(out *PathSettings) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PathSettings.
+func (in *PathSettings) DeepCopy() *PathSettings {
+	if in == nil {
+		return nil
+	}
+	out := new(PathSettings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PerRetryPolicy) DeepCopyInto(out *PerRetryPolicy) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.BackOff != nil {
+		in, out := &in.BackOff, &out.BackOff
+		*out = new(BackOffPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PerRetryPolicy.
+func (in *PerRetryPolicy) DeepCopy() *PerRetryPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(PerRetryPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyInfra) DeepCopyInto(out *ProxyInfra) {
+	*out = *in
+	if in.Metadata != nil {
+		in, out := &in.Metadata, &out.Metadata
+		*out = new(InfraMetadata)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Config != nil {
+		in, out := &in.Config, &out.Config
+		*out = new(v1alpha1.EnvoyProxy)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Listeners != nil {
+		in, out := &in.Listeners, &out.Listeners
+		*out = make([]*ProxyListener, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(ProxyListener)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Addresses != nil {
+		in, out := &in.Addresses, &out.Addresses
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyInfra.
+func (in *ProxyInfra) DeepCopy() *ProxyInfra {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyInfra)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyListener) DeepCopyInto(out *ProxyListener) {
+	*out = *in
+	if in.Address != nil {
+		in, out := &in.Address, &out.Address
+		*out = new(string)
+		**out = **in
+	}
+	if in.Ports != nil {
+		in, out := &in.Ports, &out.Ports
+		*out = make([]ListenerPort, len(*in))
+		copy(*out, *in)
+	}
+	if in.HTTP3 != nil {
+		in, out := &in.HTTP3, &out.HTTP3
+		*out = new(HTTP3Settings)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyListener.
+func (in *ProxyListener) DeepCopy() *ProxyListener {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyListener)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyProtocol) DeepCopyInto(out *ProxyProtocol) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyProtocol.
+func (in *ProxyProtocol) DeepCopy() *ProxyProtocol {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyProtocol)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Random) DeepCopyInto(out *Random) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Random.
+func (in *Random) DeepCopy() *Random {
+	if in == nil {
+		return nil
+	}
+	out := new(Random)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RateLimit) DeepCopyInto(out *RateLimit) {
+	*out = *in
+	if in.Global != nil {
+		in, out := &in.Global, &out.Global
+		*out = new(GlobalRateLimit)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Local != nil {
+		in, out := &in.Local, &out.Local
+		*out = new(LocalRateLimit)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimit.
+func (in *RateLimit) DeepCopy() *RateLimit {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimit)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RateLimitRule) DeepCopyInto(out *RateLimitRule) {
+	*out = *in
+	if in.HeaderMatches != nil {
+		in, out := &in.HeaderMatches, &out.HeaderMatches
+		*out = make([]*StringMatch, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StringMatch)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.CIDRMatch != nil {
+		in, out := &in.CIDRMatch, &out.CIDRMatch
+		*out = new(CIDRMatch)
+		**out = **in
+	}
+	out.Limit = in.Limit
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitRule.
+func (in *RateLimitRule) DeepCopy() *RateLimitRule {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RateLimitValue) DeepCopyInto(out *RateLimitValue) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitValue.
+func (in *RateLimitValue) DeepCopy() *RateLimitValue {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitValue)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Redirect) DeepCopyInto(out *Redirect) {
+	*out = *in
+	if in.Scheme != nil {
+		in, out := &in.Scheme, &out.Scheme
+		*out = new(string)
+		**out = **in
+	}
+	if in.Hostname != nil {
+		in, out := &in.Hostname, &out.Hostname
+		*out = new(string)
+		**out = **in
+	}
+	if in.Path != nil {
+		in, out := &in.Path, &out.Path
+		*out = new(HTTPPathModifier)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Port != nil {
+		in, out := &in.Port, &out.Port
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.StatusCode != nil {
+		in, out := &in.StatusCode, &out.StatusCode
+		*out = new(int32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Redirect.
+func (in *Redirect) DeepCopy() *Redirect {
+	if in == nil {
+		return nil
+	}
+	out := new(Redirect)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Retry) DeepCopyInto(out *Retry) {
+	*out = *in
+	if in.NumRetries != nil {
+		in, out := &in.NumRetries, &out.NumRetries
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.RetryOn != nil {
+		in, out := &in.RetryOn, &out.RetryOn
+		*out = new(RetryOn)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.PerRetry != nil {
+		in, out := &in.PerRetry, &out.PerRetry
+		*out = new(PerRetryPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Retry.
+func (in *Retry) DeepCopy() *Retry {
+	if in == nil {
+		return nil
+	}
+	out := new(Retry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RetryOn) DeepCopyInto(out *RetryOn) {
+	*out = *in
+	if in.Triggers != nil {
+		in, out := &in.Triggers, &out.Triggers
+		*out = make([]TriggerEnum, len(*in))
+		copy(*out, *in)
+	}
+	if in.HTTPStatusCodes != nil {
+		in, out := &in.HTTPStatusCodes, &out.HTTPStatusCodes
+		*out = make([]HTTPStatus, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RetryOn.
+func (in *RetryOn) DeepCopy() *RetryOn {
+	if in == nil {
+		return nil
+	}
+	out := new(RetryOn)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RoundRobin) DeepCopyInto(out *RoundRobin) {
+	*out = *in
+	if in.SlowStart != nil {
+		in, out := &in.SlowStart, &out.SlowStart
+		*out = new(SlowStart)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoundRobin.
+func (in *RoundRobin) DeepCopy() *RoundRobin {
+	if in == nil {
+		return nil
+	}
+	out := new(RoundRobin)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RouteDestination) DeepCopyInto(out *RouteDestination) {
+	*out = *in
+	if in.Settings != nil {
+		in, out := &in.Settings, &out.Settings
+		*out = make([]*DestinationSetting, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(DestinationSetting)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RouteDestination.
+func (in *RouteDestination) DeepCopy() *RouteDestination {
+	if in == nil {
+		return nil
+	}
+	out := new(RouteDestination)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SlowStart) DeepCopyInto(out *SlowStart) {
+	*out = *in
+	if in.Window != nil {
+		in, out := &in.Window, &out.Window
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SlowStart.
+func (in *SlowStart) DeepCopy() *SlowStart {
+	if in == nil {
+		return nil
+	}
+	out := new(SlowStart)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StringMatch) DeepCopyInto(out *StringMatch) {
+	*out = *in
+	if in.Exact != nil {
+		in, out := &in.Exact, &out.Exact
+		*out = new(string)
+		**out = **in
+	}
+	if in.Prefix != nil {
+		in, out := &in.Prefix, &out.Prefix
+		*out = new(string)
+		**out = **in
+	}
+	if in.Suffix != nil {
+		in, out := &in.Suffix, &out.Suffix
+		*out = new(string)
+		**out = **in
+	}
+	if in.SafeRegex != nil {
+		in, out := &in.SafeRegex, &out.SafeRegex
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StringMatch.
+func (in *StringMatch) DeepCopy() *StringMatch {
+	if in == nil {
+		return nil
+	}
+	out := new(StringMatch)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPHealthChecker) DeepCopyInto(out *TCPHealthChecker) {
+	*out = *in
+	if in.Send != nil {
+		in, out := &in.Send, &out.Send
+		*out = new(HealthCheckPayload)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Receive != nil {
+		in, out := &in.Receive, &out.Receive
+		*out = new(HealthCheckPayload)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPHealthChecker.
+func (in *TCPHealthChecker) DeepCopy() *TCPHealthChecker {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPHealthChecker)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPKeepalive) DeepCopyInto(out *TCPKeepalive) {
+	*out = *in
+	if in.Probes != nil {
+		in, out := &in.Probes, &out.Probes
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.IdleTime != nil {
+		in, out := &in.IdleTime, &out.IdleTime
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(uint32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPKeepalive.
+func (in *TCPKeepalive) DeepCopy() *TCPKeepalive {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPKeepalive)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPListener) DeepCopyInto(out *TCPListener) {
+	*out = *in
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLS)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Destination != nil {
+		in, out := &in.Destination, &out.Destination
+		*out = new(RouteDestination)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TCPKeepalive != nil {
+		in, out := &in.TCPKeepalive, &out.TCPKeepalive
+		*out = new(TCPKeepalive)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPListener.
+func (in *TCPListener) DeepCopy() *TCPListener {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPListener)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPTimeout) DeepCopyInto(out *TCPTimeout) {
+	*out = *in
+	if in.ConnectTimeout != nil {
+		in, out := &in.ConnectTimeout, &out.ConnectTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPTimeout.
+func (in *TCPTimeout) DeepCopy() *TCPTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLS) DeepCopyInto(out *TLS) {
+	*out = *in
+	if in.Passthrough != nil {
+		in, out := &in.Passthrough, &out.Passthrough
+		*out = new(TLSInspectorConfig)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Terminate != nil {
+		in, out := &in.Terminate, &out.Terminate
+		*out = new(TLSConfig)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLS.
+func (in *TLS) DeepCopy() *TLS {
+	if in == nil {
+		return nil
+	}
+	out := new(TLS)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSCACertificate) DeepCopyInto(out *TLSCACertificate) {
+	*out = *in
+	if in.Certificate != nil {
+		in, out := &in.Certificate, &out.Certificate
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSCACertificate.
+func (in *TLSCACertificate) DeepCopy() *TLSCACertificate {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSCACertificate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSCertificate) DeepCopyInto(out *TLSCertificate) {
+	*out = *in
+	if in.ServerCertificate != nil {
+		in, out := &in.ServerCertificate, &out.ServerCertificate
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.PrivateKey != nil {
+		in, out := &in.PrivateKey, &out.PrivateKey
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSCertificate.
+func (in *TLSCertificate) DeepCopy() *TLSCertificate {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSCertificate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSConfig) DeepCopyInto(out *TLSConfig) {
+	*out = *in
+	if in.Certificates != nil {
+		in, out := &in.Certificates, &out.Certificates
+		*out = make([]TLSCertificate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.CACertificate != nil {
+		in, out := &in.CACertificate, &out.CACertificate
+		*out = new(TLSCACertificate)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.MinVersion != nil {
+		in, out := &in.MinVersion, &out.MinVersion
+		*out = new(TLSVersion)
+		**out = **in
+	}
+	if in.MaxVersion != nil {
+		in, out := &in.MaxVersion, &out.MaxVersion
+		*out = new(TLSVersion)
+		**out = **in
+	}
+	if in.Ciphers != nil {
+		in, out := &in.Ciphers, &out.Ciphers
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ECDHCurves != nil {
+		in, out := &in.ECDHCurves, &out.ECDHCurves
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.SignatureAlgorithms != nil {
+		in, out := &in.SignatureAlgorithms, &out.SignatureAlgorithms
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ALPNProtocols != nil {
+		in, out := &in.ALPNProtocols, &out.ALPNProtocols
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig.
+func (in *TLSConfig) DeepCopy() *TLSConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSInspectorConfig) DeepCopyInto(out *TLSInspectorConfig) {
+	*out = *in
+	if in.SNIs != nil {
+		in, out := &in.SNIs, &out.SNIs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSInspectorConfig.
+func (in *TLSInspectorConfig) DeepCopy() *TLSInspectorConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSInspectorConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSUpstreamConfig) DeepCopyInto(out *TLSUpstreamConfig) {
+	*out = *in
+	if in.CACertificate != nil {
+		in, out := &in.CACertificate, &out.CACertificate
+		*out = new(TLSCACertificate)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSUpstreamConfig.
+func (in *TLSUpstreamConfig) DeepCopy() *TLSUpstreamConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSUpstreamConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TextAccessLog) DeepCopyInto(out *TextAccessLog) {
+	*out = *in
+	if in.Format != nil {
+		in, out := &in.Format, &out.Format
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TextAccessLog.
+func (in *TextAccessLog) DeepCopy() *TextAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(TextAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Timeout) DeepCopyInto(out *Timeout) {
+	*out = *in
+	if in.TCP != nil {
+		in, out := &in.TCP, &out.TCP
+		*out = new(TCPTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Timeout.
+func (in *Timeout) DeepCopy() *Timeout {
+	if in == nil {
+		return nil
+	}
+	out := new(Timeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Tracing) DeepCopyInto(out *Tracing) {
+	*out = *in
+	in.ProxyTracing.DeepCopyInto(&out.ProxyTracing)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Tracing.
+func (in *Tracing) DeepCopy() *Tracing {
+	if in == nil {
+		return nil
+	}
+	out := new(Tracing)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UDPListener) DeepCopyInto(out *UDPListener) {
+	*out = *in
+	if in.Destination != nil {
+		in, out := &in.Destination, &out.Destination
+		*out = new(RouteDestination)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UDPListener.
+func (in *UDPListener) DeepCopy() *UDPListener {
+	if in == nil {
+		return nil
+	}
+	out := new(UDPListener)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *URLRewrite) DeepCopyInto(out *URLRewrite) {
+	*out = *in
+	if in.Path != nil {
+		in, out := &in.Path, &out.Path
+		*out = new(HTTPPathModifier)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Hostname != nil {
+		in, out := &in.Hostname, &out.Hostname
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new URLRewrite.
+func (in *URLRewrite) DeepCopy() *URLRewrite {
+	if in == nil {
+		return nil
+	}
+	out := new(URLRewrite)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UnstructuredRef) DeepCopyInto(out *UnstructuredRef) {
+	*out = *in
+	if in.Object != nil {
+		in, out := &in.Object, &out.Object
+		*out = (*in).DeepCopy()
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UnstructuredRef.
+func (in *UnstructuredRef) DeepCopy() *UnstructuredRef {
+	if in == nil {
+		return nil
+	}
+	out := new(UnstructuredRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Xds) DeepCopyInto(out *Xds) {
+	*out = *in
+	if in.AccessLog != nil {
+		in, out := &in.AccessLog, &out.AccessLog
+		*out = new(AccessLog)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Tracing != nil {
+		in, out := &in.Tracing, &out.Tracing
+		*out = new(Tracing)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Metrics != nil {
+		in, out := &in.Metrics, &out.Metrics
+		*out = new(Metrics)
+		**out = **in
+	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = make([]*HTTPListener, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(HTTPListener)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.TCP != nil {
+		in, out := &in.TCP, &out.TCP
+		*out = make([]*TCPListener, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(TCPListener)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.UDP != nil {
+		in, out := &in.UDP, &out.UDP
+		*out = make([]*UDPListener, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(UDPListener)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Xds.
+func (in *Xds) DeepCopy() *Xds {
+	if in == nil {
+		return nil
+	}
+	out := new(Xds)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/adapter/internal/operator/gateway-api/listener.go b/adapter/internal/operator/gateway-api/listener.go
new file mode 100644
index 000000000..81ef56d40
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/listener.go
@@ -0,0 +1,191 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+var _ ListenersTranslator = (*Translator)(nil)
+
+type ListenersTranslator interface {
+	ProcessListeners(gateways []*GatewayContext, xdsIR XdsIRMap, infraIR InfraIRMap, resources *Resources)
+}
+
+func (t *Translator) ProcessListeners(gateways []*GatewayContext, xdsIR XdsIRMap, infraIR InfraIRMap, resources *Resources) {
+	// Infra IR proxy ports must be unique.
+	foundPorts := make(map[string][]*protocolPort)
+	t.validateConflictedLayer7Listeners(gateways)
+	t.validateConflictedLayer4Listeners(gateways, gwapiv1.TCPProtocolType, gwapiv1.TLSProtocolType)
+	t.validateConflictedLayer4Listeners(gateways, gwapiv1.UDPProtocolType)
+	if t.MergeGateways {
+		t.validateConflictedMergedListeners(gateways)
+	}
+
+	// Iterate through all listeners to validate spec
+	// and compute status for each, and add valid ones
+	// to the Xds IR.
+	for _, gateway := range gateways {
+		irKey := t.getIRKey(gateway.Gateway)
+
+		xdsIR[irKey].AccessLog = processAccessLog()
+		xdsIR[irKey].Tracing = processTracing()
+		xdsIR[irKey].Metrics = processMetrics()
+
+		for _, listener := range gateway.listeners {
+			// Process protocol & supported kinds
+			switch listener.Protocol {
+			case gwapiv1.TLSProtocolType:
+				if listener.TLS != nil {
+					switch *listener.TLS.Mode {
+					case gwapiv1.TLSModePassthrough:
+						t.validateAllowedRoutes(listener, KindTLSRoute)
+					case gwapiv1.TLSModeTerminate:
+						t.validateAllowedRoutes(listener, KindTCPRoute)
+					default:
+						t.validateAllowedRoutes(listener, KindTCPRoute, KindTLSRoute)
+					}
+				} else {
+					t.validateAllowedRoutes(listener, KindTCPRoute, KindTLSRoute)
+				}
+			case gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType:
+				t.validateAllowedRoutes(listener, KindHTTPRoute, KindGRPCRoute)
+			case gwapiv1.TCPProtocolType:
+				t.validateAllowedRoutes(listener, KindTCPRoute)
+			case gwapiv1.UDPProtocolType:
+				t.validateAllowedRoutes(listener, KindUDPRoute)
+			default:
+				listener.SetCondition(
+					gwapiv1.ListenerConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.ListenerReasonUnsupportedProtocol,
+					fmt.Sprintf("Protocol %s is unsupported, must be %s, %s, %s or %s.", listener.Protocol,
+						gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType, gwapiv1.TCPProtocolType, gwapiv1.UDPProtocolType),
+				)
+			}
+
+			// Validate allowed namespaces
+			t.validateAllowedNamespaces(listener)
+
+			// Process TLS configuration
+			t.validateTLSConfiguration(listener, resources)
+
+			// Process Hostname configuration
+			t.validateHostName(listener)
+
+			// Process conditions and check if the listener is ready
+			isReady := t.validateListenerConditions(listener)
+			if !isReady {
+				continue
+			}
+			// Add the listener to the Xds IR
+			servicePort := &protocolPort{protocol: listener.Protocol, port: int32(listener.Port)}
+			containerPort := servicePortToContainerPort(servicePort.port)
+			switch listener.Protocol {
+			case gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType:
+				irListener := &ir.HTTPListener{
+					Name:    irHTTPListenerName(listener),
+					Address: "0.0.0.0",
+					Port:    uint32(containerPort),
+					TLS:     irTLSConfigs(listener.tlsSecrets),
+					Path: ir.PathSettings{
+						MergeSlashes: true,
+					},
+				}
+				if listener.Hostname != nil {
+					irListener.Hostnames = append(irListener.Hostnames, string(*listener.Hostname))
+				} else {
+					// Hostname specifies the virtual hostname to match for protocol types that define this concept.
+					// When unspecified, all hostnames are matched. This field is ignored for protocols that don’t require hostname based matching.
+					// see more https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/gwapiv1.Listener.
+					irListener.Hostnames = append(irListener.Hostnames, "*")
+				}
+				xdsIR[irKey].HTTP = append(xdsIR[irKey].HTTP, irListener)
+			}
+
+			// Add the listener to the Infra IR. Infra IR ports must have a unique port number per layer-4 protocol
+			// (TCP or UDP).
+			if !containsPort(foundPorts[irKey], servicePort) {
+				t.processInfraIRListener(listener, infraIR, irKey, servicePort)
+				foundPorts[irKey] = append(foundPorts[irKey], servicePort)
+			}
+		}
+	}
+}
+
+func (t *Translator) processInfraIRListener(listener *ListenerContext, infraIR InfraIRMap, irKey string, servicePort *protocolPort) {
+	var proto ir.ProtocolType
+	switch listener.Protocol {
+	case gwapiv1.HTTPProtocolType:
+		proto = ir.HTTPProtocolType
+	case gwapiv1.HTTPSProtocolType:
+		proto = ir.HTTPSProtocolType
+	case gwapiv1.TLSProtocolType:
+		proto = ir.TLSProtocolType
+	case gwapiv1.TCPProtocolType:
+		proto = ir.TCPProtocolType
+	case gwapiv1.UDPProtocolType:
+		proto = ir.UDPProtocolType
+	}
+
+	infraPortName := string(listener.Name)
+	if t.MergeGateways {
+		infraPortName = irHTTPListenerName(listener)
+	}
+	infraPort := ir.ListenerPort{
+		Name:          infraPortName,
+		Protocol:      proto,
+		ServicePort:   servicePort.port,
+		ContainerPort: servicePortToContainerPort(servicePort.port),
+	}
+
+	proxyListener := &ir.ProxyListener{
+		Name:  irHTTPListenerName(listener),
+		Ports: []ir.ListenerPort{infraPort},
+	}
+
+	infraIR[irKey].Proxy.Listeners = append(infraIR[irKey].Proxy.Listeners, proxyListener)
+}
+
+func processAccessLog() *ir.AccessLog {
+	// use the default access log
+	return &ir.AccessLog{
+		Text: []*ir.TextAccessLog{
+			{
+				Path: "/dev/stdout",
+			},
+		},
+	}
+}
+
+func processTracing() *ir.Tracing {
+	return nil
+}
+
+func processMetrics() *ir.Metrics {
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
new file mode 100644
index 000000000..de30222c9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
@@ -0,0 +1,744 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package kubernetes
+
+// todo(amali) verify gateway api latest imports
+// todo(amali) fix formatting in logs
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/config"
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/pkg/logging"
+	"github.com/wso2/apk/adapter/pkg/utils/stringutils"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/wso2/apk/adapter/internal/operator/constants"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/operator/status"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	discoveryv1 "k8s.io/api/discovery/v1"
+	k8errors "k8s.io/apimachinery/pkg/api/errors"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	"sigs.k8s.io/controller-runtime/pkg/source"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+type gatewayReconcilerNew struct {
+	client        client.Client
+	statusUpdater *status.UpdateHandler
+	mgr           manager.Manager
+	resources     *message.ProviderResources
+	extGVKs       []schema.GroupVersionKind
+	namespace     string
+	store         *kubernetesProviderStore
+}
+
+type resourceMappings struct {
+	// Map for storing namespaces for Route, Service and Gateway objects.
+	allAssociatedNamespaces map[string]struct{}
+	// Map for storing backendRefs' NamespaceNames referred by various Route objects.
+	allAssociatedBackendRefs map[gwapiv1.BackendObjectReference]struct{}
+	// extensionRefFilters is a map of filters managed by an extension.
+	// The key is the namespaced name of the filter and the value is the
+	// unstructured form of the resource.
+	extensionRefFilters map[types.NamespacedName]unstructured.Unstructured
+}
+
+const (
+	gatewayClassControllerName = "wso2.com/apk-gateway-default"
+	gatewayClassFinalizer      = gwapiv1.GatewayClassFinalizerGatewaysExist
+)
+
+// InitGatewayController creates a new Gateway controller instance. Gateway Controllers watches for gwapiv1.Gateway.
+func InitGatewayController(mgr manager.Manager, pResourses *message.ProviderResources, statusUpdater *status.UpdateHandler) error {
+	conf := config.ReadConfigs()
+	r := &gatewayReconcilerNew{
+		client:        mgr.GetClient(),
+		statusUpdater: statusUpdater,
+		mgr:           mgr,
+		resources:     pResourses,
+		namespace:     conf.Envoy.Namespace,
+		store:         newProviderStore(),
+	}
+	c, err := controller.New(constants.GatewayControllerNew, mgr, controller.Options{Reconciler: r})
+	if err != nil {
+		loggers.LoggerAPKOperator.ErrorC(logging.PrintError(logging.Error3119, logging.BLOCKER, "Error creating API controller, error: %v", err))
+		return err
+	}
+
+	ctx := context.Background()
+	// Watch resources
+	if err := r.watchResources(ctx, mgr, c); err != nil {
+		return err
+	}
+	// Subscribe to status updates
+	r.subscribeAndUpdateStatus(ctx)
+	loggers.LoggerAPKOperator.Info("New Controller successfully started. Watching Gateway Objects....")
+	return nil
+}
+
+// Reconcile handles reconciling all resources in a single call. Any resource event should enqueue the
+// same reconcile.Request containing the gateway controller name. This allows multiple resource updates to
+// be handled by a single call to Reconcile. The reconcile.Request DOES NOT map to a specific resource.
+func (r *gatewayReconcilerNew) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	var (
+		managedGCs []*gwapiv1.GatewayClass
+		err        error
+	)
+
+	loggers.LoggerAPKOperator.Infof("Reconciling all gateways due to change in %s:%s", req.Namespace, req.Name)
+
+	// Get the GatewayClasses managed by the Envoy Gateway Controller.
+	managedGCs, err = r.managedGatewayClasses(ctx)
+	if err != nil {
+		return reconcile.Result{}, err
+	}
+
+	// The gatewayclass was already deleted/finalized and there are stale queue entries.
+	if managedGCs == nil {
+		r.resources.GatewayAPIResources.Delete(string(gatewayClassControllerName))
+		loggers.LoggerAPKOperator.Info("no accepted gatewayclass")
+		return reconcile.Result{}, nil
+	}
+
+	// we only manage one gatewayclass
+	managedGC := managedGCs[0]
+
+	// Collect all the Gateway API resources, Envoy Gateway customized resources,
+	// and their referenced resources for the managed GatewayClasses, and store
+	// them per GatewayClass.
+	// For example:
+	// - Gateway API resources: Gateways, xRoutes ...
+	// - Referenced resources: Services, ServiceImports, EndpointSlices, Secrets, ConfigMaps ...
+	gwcResource := gatewayapi.NewResources()
+	gwcResource.GatewayClass = managedGC
+	gwcResources := gatewayapi.ControllerResources{gwcResource}
+	resourceMappings := newResourceMapping()
+
+	// Add all Gateways, their associated Routes, and referenced resources to the resourceTree
+	if err = r.processGateways(ctx, managedGC, resourceMappings, gwcResource); err != nil {
+		return reconcile.Result{}, err
+	}
+
+	// Add the referenced services, ServiceImports, and EndpointSlices in
+	// the collected BackendRefs to the resourceTree.
+	// BackendRefs are referred by various Route objects and the ExtAuth in SecurityPolicies.
+	r.processBackendRefs(ctx, gwcResource, resourceMappings)
+
+	// For this particular Gateway, and all associated objects, check whether the
+	// namespace exists. Add to the resourceTree.
+	for ns := range resourceMappings.allAssociatedNamespaces {
+		namespace, err := r.getNamespace(ctx, ns)
+		if err != nil {
+			loggers.LoggerAPKOperator.Error("Unable to find the namespace ", err)
+			if k8errors.IsNotFound(err) {
+				return reconcile.Result{}, nil
+			}
+			return reconcile.Result{}, err
+		}
+
+		gwcResource.Namespaces = append(gwcResource.Namespaces, namespace)
+	}
+
+	if err := r.updateStatusForGatewayClass(ctx, managedGC, true, string(gwapiv1.GatewayClassReasonAccepted), status.MsgValidGatewayClass); err != nil {
+		loggers.LoggerAPKOperator.Errorf("Unable to update GatewayClass %s status %v", managedGC.Name, err)
+		return reconcile.Result{}, err
+	}
+	if len(gwcResource.Gateways) == 0 {
+		loggers.LoggerAPKOperator.Info("No gateways found for accepted gatewayclass ", managedGC.Name)
+
+		// If needed, remove the finalizer from the accepted GatewayClass.
+		if err := r.removeFinalizer(ctx, managedGC); err != nil {
+			loggers.LoggerAPKOperator.Errorf("Failed to remove finalizer from gatewayclass %s, %v",
+				managedGC.Name, err)
+			return reconcile.Result{}, err
+		}
+	} else {
+		// finalize the accepted GatewayClass.
+		if err := r.addFinalizer(ctx, managedGC); err != nil {
+			loggers.LoggerAPKOperator.Errorf("Failed adding finalizer to gatewayclass %s, %v",
+				managedGC.Name, err)
+			return reconcile.Result{}, err
+		}
+	}
+
+	// Store the Gateway Resources for the GatewayClass.
+	// The Store is triggered even when there are no Gateways associated to the
+	// GatewayClass. This would happen in case the last Gateway is removed and the
+	// Store will be required to trigger a cleanup of envoy infra resources.
+	r.resources.GatewayAPIResources.Store(gatewayClassControllerName, &gwcResources)
+
+	return ctrl.Result{}, nil
+}
+
+// managedGatewayClasses returns a list of GatewayClass objects that are managed by the Envoy Gateway Controller.
+func (r *gatewayReconcilerNew) managedGatewayClasses(ctx context.Context) ([]*gwapiv1.GatewayClass, error) {
+	var gatewayClasses gwapiv1.GatewayClassList
+	if err := r.client.List(ctx, &gatewayClasses); err != nil {
+		return nil, fmt.Errorf("error listing gatewayclasses: %w", err)
+	}
+
+	var cc controlledClasses
+
+	for _, gwClass := range gatewayClasses.Items {
+		gwClass := gwClass
+		if gwClass.Spec.ControllerName == gatewayClassControllerName {
+			// The gatewayclass was marked for deletion and the finalizer removed,
+			// so clean-up dependents.
+			if !gwClass.DeletionTimestamp.IsZero() &&
+				!stringutils.StringInSlice(gatewayClassFinalizer, gwClass.Finalizers) {
+				loggers.LoggerAPKOperator.Info("Gatewayclass marked for deletion")
+				cc.removeMatch(&gwClass)
+				continue
+			}
+
+			cc.addMatch(&gwClass)
+		}
+	}
+
+	return cc.matchedClasses, nil
+}
+
+func newResourceMapping() *resourceMappings {
+	return &resourceMappings{
+		allAssociatedNamespaces:  map[string]struct{}{},
+		allAssociatedBackendRefs: map[gwapiv1.BackendObjectReference]struct{}{},
+		extensionRefFilters:      map[types.NamespacedName]unstructured.Unstructured{},
+	}
+}
+
+func (r *gatewayReconcilerNew) processGateways(ctx context.Context, managedGC *gwapiv1.GatewayClass, resourceMap *resourceMappings, resourceTree *gatewayapi.Resources) error {
+	// Find gateways for the managedGC
+	// Find the Gateways that reference this Class.
+	gatewayList := &gwapiv1.GatewayList{}
+	if err := r.client.List(ctx, gatewayList, &client.ListOptions{
+		FieldSelector: fields.OneTermEqualSelector(classGatewayIndex, managedGC.Name),
+	}); err != nil || len(gatewayList.Items) < 1 {
+		loggers.LoggerAPKOperator.Infof("No associated Gateways found for GatewayClass name %s, %v", managedGC.Name, err)
+		return err
+	}
+
+	for _, gtw := range gatewayList.Items {
+		loggers.LoggerAPKOperator.Infof("Processing Gateway namespace %s: Name %s", gtw.Namespace, gtw.Name)
+		resourceMap.allAssociatedNamespaces[gtw.Namespace] = struct{}{}
+
+		for _, listener := range gtw.Spec.Listeners {
+			// Get Secret for gateway if it exists.
+			if terminatesTLS(&listener) {
+				for _, certRef := range listener.TLS.CertificateRefs {
+					certRef := certRef
+					if refsSecret(&certRef) {
+						if err := r.processSecretRef(ctx, resourceMap, resourceTree, gatewayapi.KindGateway, gtw.Namespace,
+							gtw.Name, certRef); err != nil {
+							loggers.LoggerAPKOperator.Errorf("Failed to process TLS SecretRef for gateway %+v, secretRef %+v, Error: %v", gtw, certRef, err)
+						}
+					}
+				}
+			}
+		}
+
+		// Get HTTPRoute objects and check if it exists.
+		if err := r.processHTTPRoutes(ctx, utils.NamespacedName(&gtw).String(), resourceMap, resourceTree); err != nil {
+			return err
+		}
+
+		// Discard Status to reduce memory consumption in watchable
+		// It will be recomputed by the gateway-api layer
+		gtw.Status = gwapiv1.GatewayStatus{}
+		resourceTree.Gateways = append(resourceTree.Gateways, &gtw)
+	}
+
+	return nil
+}
+
+// processSecretRef adds the referenced Secret to the resourceTree if it's valid.
+// - If it exists in the same namespace as the owner.
+// - If it exists in a different namespace, and there is a ReferenceGrant.
+func (r *gatewayReconcilerNew) processSecretRef(
+	ctx context.Context,
+	resourceMap *resourceMappings,
+	resourceTree *gatewayapi.Resources,
+	ownerKind string,
+	ownerNS string,
+	ownerName string,
+	secretRef gwapiv1.SecretObjectReference,
+) error {
+	secret := new(corev1.Secret)
+	secretNS := gatewayapi.NamespaceDerefOr(secretRef.Namespace, ownerNS)
+	err := r.client.Get(ctx,
+		types.NamespacedName{Namespace: secretNS, Name: string(secretRef.Name)},
+		secret,
+	)
+	if err != nil {
+		return fmt.Errorf("unable to find the Secret: %s/%s, Error: %v", secretNS, string(secretRef.Name), err)
+	}
+	if secretNS != ownerNS {
+		from := ObjectKindNamespacedName{
+			kind:      ownerKind,
+			namespace: ownerNS,
+			name:      ownerName,
+		}
+		to := ObjectKindNamespacedName{
+			kind:      gatewayapi.KindSecret,
+			namespace: secretNS,
+			name:      secret.Name,
+		}
+		refGrant, err := r.findReferenceGrant(ctx, from, to)
+		switch {
+		case err != nil:
+			return fmt.Errorf("failed to find ReferenceGrant: %w", err)
+		case refGrant == nil:
+			return fmt.Errorf(
+				"no matching ReferenceGrants found: from %s/%s to %s/%s",
+				from.kind, from.namespace, to.kind, to.namespace)
+		default:
+			// RefGrant found
+			resourceTree.ReferenceGrants = append(resourceTree.ReferenceGrants, refGrant)
+			loggers.LoggerAPKOperator.Infof("Added ReferenceGrant to resource map namespace %s, name %s",
+				refGrant.Namespace, refGrant.Name)
+		}
+	}
+	resourceMap.allAssociatedNamespaces[secretNS] = struct{}{} // TODO Zhaohuabing do we need this line?
+	resourceTree.Secrets = append(resourceTree.Secrets, secret)
+	loggers.LoggerAPKOperator.Infof("Processing Secret namespace %s name %s", secretNS, string(secretRef.Name))
+	return nil
+}
+
+func (r *gatewayReconcilerNew) findReferenceGrant(ctx context.Context, from, to ObjectKindNamespacedName) (*gwapiv1b1.ReferenceGrant, error) {
+	refGrantList := new(gwapiv1b1.ReferenceGrantList)
+	opts := &client.ListOptions{FieldSelector: fields.OneTermEqualSelector(targetRefGrantRouteIndex, to.kind)}
+	if err := r.client.List(ctx, refGrantList, opts); err != nil {
+		return nil, fmt.Errorf("failed to list ReferenceGrants: %w", err)
+	}
+
+	refGrants := refGrantList.Items
+
+	for _, refGrant := range refGrants {
+		if refGrant.Namespace == to.namespace {
+			for _, src := range refGrant.Spec.From {
+				if src.Kind == gwapiv1.Kind(from.kind) && string(src.Namespace) == from.namespace {
+					return &refGrant, nil
+				}
+			}
+		}
+	}
+
+	// No ReferenceGrant found.
+	return nil, nil
+}
+
+func (r *gatewayReconcilerNew) enqueueClass(_ context.Context, _ client.Object) []reconcile.Request {
+	return []reconcile.Request{{NamespacedName: types.NamespacedName{
+		Name: string(gatewayClassControllerName),
+	}}}
+}
+
+// watchResources watches gateway api resources.
+func (r *gatewayReconcilerNew) watchResources(ctx context.Context, mgr manager.Manager, c controller.Controller) error {
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &gwapiv1.GatewayClass{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		predicate.GenerationChangedPredicate{},
+		predicate.NewPredicateFuncs(r.hasMatchingController),
+	); err != nil {
+		return err
+	}
+
+	// Watch Gateway CRUDs and reconcile affected GatewayClass.
+	gPredicates := []predicate.Predicate{
+		predicate.GenerationChangedPredicate{},
+		predicate.NewPredicateFuncs(r.validateGatewayForReconcile),
+	}
+
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &gwapiv1.Gateway{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		gPredicates...,
+	); err != nil {
+		return err
+	}
+	if err := addGatewayIndexers(ctx, mgr); err != nil {
+		return err
+	}
+
+	// Watch HTTPRoute CRUDs and process affected Gateways.
+	httprPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &gwapiv1.HTTPRoute{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		httprPredicates...,
+	); err != nil {
+		return err
+	}
+	if err := addHTTPRouteIndexers(ctx, mgr); err != nil {
+		return err
+	}
+
+	// // Watch GRPCRoute CRUDs and process affected Gateways.
+	// grpcrPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &gwapiv1a2.GRPCRoute{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	grpcrPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+	// if err := addGRPCRouteIndexers(ctx, mgr); err != nil {
+	// 	return err
+	// }
+
+	// // Watch TLSRoute CRUDs and process affected Gateways.
+	// tlsrPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if r.namespaceLabel != nil {
+	// 	tlsrPredicates = append(tlsrPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &gwapiv1a2.TLSRoute{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	tlsrPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+	// if err := addTLSRouteIndexers(ctx, mgr); err != nil {
+	// 	return err
+	// }
+
+	// // Watch UDPRoute CRUDs and process affected Gateways.
+	// udprPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if r.namespaceLabel != nil {
+	// 	udprPredicates = append(udprPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &gwapiv1a2.UDPRoute{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	udprPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+	// if err := addUDPRouteIndexers(ctx, mgr); err != nil {
+	// 	return err
+	// }
+
+	// // Watch TCPRoute CRUDs and process affected Gateways.
+	// tcprPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if r.namespaceLabel != nil {
+	// 	tcprPredicates = append(tcprPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &gwapiv1a2.TCPRoute{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	tcprPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+	// if err := addTCPRouteIndexers(ctx, mgr); err != nil {
+	// 	return err
+	// }
+
+	// Watch Service CRUDs and process affected *Route objects and services belongs to gateways
+	servicePredicates := []predicate.Predicate{predicate.NewPredicateFuncs(r.validateServiceForReconcile)}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &corev1.Service{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		servicePredicates...,
+	); err != nil {
+		return err
+	}
+
+	// serviceImportCRDExists := r.serviceImportCRDExists(mgr)
+	// if !serviceImportCRDExists {
+	// 	loggers.LoggerAPKOperator.Info("ServiceImport CRD not found, skipping ServiceImport watch")
+	// }
+
+	// // Watch ServiceImport CRUDs and process affected *Route objects.
+	// if serviceImportCRDExists {
+	// 	if err := c.Watch(
+	// 		source.Kind(mgr.GetCache(), &mcsapi.ServiceImport{}),
+	// 		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 		predicate.GenerationChangedPredicate{},
+	// 		predicate.NewPredicateFuncs(r.validateServiceImportForReconcile)); err != nil {
+	// 		// ServiceImport is not available in the cluster, skip the watch and not throw error.
+	// 		loggers.LoggerAPKOperator.Info("unable to watch ServiceImport: %s", err.Error())
+	// 	}
+	// }
+
+	// // Watch EndpointSlice CRUDs and process affected *Route objects.
+	// esPredicates := []predicate.Predicate{
+	// 	predicate.GenerationChangedPredicate{},
+	// 	predicate.NewPredicateFuncs(r.validateEndpointSliceForReconcile),
+	// }
+	// if r.namespaceLabel != nil {
+	// 	esPredicates = append(esPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &discoveryv1.EndpointSlice{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	esPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+
+	// Watch Node CRUDs to update Gateway Address exposed by Service of type NodePort.
+	// Node creation/deletion and ExternalIP updates would require update in the Gateway
+	nPredicates := []predicate.Predicate{
+		predicate.GenerationChangedPredicate{},
+		predicate.NewPredicateFuncs(r.handleNode),
+	}
+	// resource address.
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &corev1.Node{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		nPredicates...,
+	); err != nil {
+		return err
+	}
+
+	// Watch Secret CRUDs and process affected EG CRs (Gateway, SecurityPolicy, more in the future).
+	secretPredicates := []predicate.Predicate{
+		predicate.GenerationChangedPredicate{},
+		predicate.NewPredicateFuncs(r.validateSecretForReconcile),
+	}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &corev1.Secret{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		secretPredicates...,
+	); err != nil {
+		return err
+	}
+
+	// // Watch ConfigMap CRUDs and process affected ClienTraffiPolicies and BackendTLSPolicies.
+	// configMapPredicates := []predicate.Predicate{
+	// 	predicate.GenerationChangedPredicate{},
+	// 	predicate.NewPredicateFuncs(r.validateConfigMapForReconcile),
+	// }
+	// if r.namespaceLabel != nil {
+	// 	configMapPredicates = append(configMapPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &corev1.ConfigMap{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	configMapPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+
+	// Watch ReferenceGrant CRUDs and process affected Gateways.
+	rgPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &gwapiv1b1.ReferenceGrant{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		rgPredicates...,
+	); err != nil {
+		return err
+	}
+	if err := addReferenceGrantIndexers(ctx, mgr); err != nil {
+		return err
+	}
+
+	// Watch Deployment CRUDs and process affected Gateways.
+	dPredicates := []predicate.Predicate{predicate.NewPredicateFuncs(r.validateDeploymentForReconcile)}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &appsv1.Deployment{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		dPredicates...,
+	); err != nil {
+		return err
+	}
+
+	// // Watch BackendTLSPolicy
+	// btlsPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if r.namespaceLabel != nil {
+	// 	btlsPredicates = append(btlsPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &gwapiv1a2.BackendTLSPolicy{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	btlsPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+
+	// if err := addBtlsIndexers(ctx, mgr); err != nil {
+	// 	return err
+	// }
+
+	// loggers.LoggerAPKOperator.Info("Watching gatewayAPI related objects")
+
+	// // Watch any additional GVKs from the registered extension.
+	// uPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if r.namespaceLabel != nil {
+	// 	uPredicates = append(uPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// for _, gvk := range r.extGVKs {
+	// 	u := &unstructured.Unstructured{}
+	// 	u.SetGroupVersionKind(gvk)
+	// 	if err := c.Watch(source.Kind(mgr.GetCache(), u),
+	// 		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 		uPredicates...,
+	// 	); err != nil {
+	// 		return err
+	// 	}
+	// 	loggers.LoggerAPKOperator.Info("Watching additional resource", "resource", gvk.String())
+	// }
+	return nil
+}
+
+// processBackendRefs adds the referenced resources in BackendRefs to the resourceTree, including:
+// - Services
+// - ServiceImports
+// - EndpointSlices
+func (r *gatewayReconcilerNew) processBackendRefs(ctx context.Context, gwcResource *gatewayapi.Resources, resourceMappings *resourceMappings) {
+	for backendRef := range resourceMappings.allAssociatedBackendRefs {
+		backendRefKind := gatewayapi.KindDerefOr(backendRef.Kind, gatewayapi.KindService)
+		loggers.LoggerAPKOperator.Infof("Processing Backend kind %s, namespace %s, name %s", backendRefKind,
+			string(*backendRef.Namespace), string(backendRef.Name))
+
+		var endpointSliceLabelKey string
+		switch backendRefKind {
+		case gatewayapi.KindService:
+			service := new(corev1.Service)
+			err := r.client.Get(ctx, types.NamespacedName{Namespace: string(*backendRef.Namespace), Name: string(backendRef.Name)}, service)
+			if err != nil {
+				loggers.LoggerAPKOperator.Errorf("Failed to get Service namespace %s, name: %s, Error: %v",
+					string(*backendRef.Namespace), string(backendRef.Name), err)
+			} else {
+				resourceMappings.allAssociatedNamespaces[service.Namespace] = struct{}{}
+				gwcResource.Services = append(gwcResource.Services, service)
+				loggers.LoggerAPKOperator.Infof("Added Service to resource tree namespace %s, name: %s",
+					string(*backendRef.Namespace), string(backendRef.Name))
+			}
+			endpointSliceLabelKey = discoveryv1.LabelServiceName
+
+		case gatewayapi.KindBackend:
+			backend := new(dpv1alpha1.Backend)
+			err := r.client.Get(ctx, types.NamespacedName{Namespace: string(*backendRef.Namespace), Name: string(backendRef.Name)}, backend)
+			if err != nil {
+				loggers.LoggerAPKOperator.Errorf("Failed to get Backend namespace %s, name %s, Error: %v", string(*backendRef.Namespace),
+					string(backendRef.Name), err)
+			} else {
+				resourceMappings.allAssociatedNamespaces[backend.Namespace] = struct{}{}
+				gwcResource.Backends = append(gwcResource.Backends, backend)
+				loggers.LoggerAPKOperator.Infof("Added Backend to resource tree namespace %s, name %s",
+					string(*backendRef.Namespace), string(backendRef.Name))
+			}
+		}
+
+		if endpointSliceLabelKey != "" {
+			// Retrieve the EndpointSlices associated with the service
+			endpointSliceList := new(discoveryv1.EndpointSliceList)
+			opts := []client.ListOption{
+				client.MatchingLabels(map[string]string{
+					endpointSliceLabelKey: string(backendRef.Name),
+				}),
+				client.InNamespace(string(*backendRef.Namespace)),
+			}
+			if err := r.client.List(ctx, endpointSliceList, opts...); err != nil {
+				loggers.LoggerAPKOperator.Errorf("Failed to get EndpointSlices namespace %s, kind %s, name %s, Error %v",
+					string(*backendRef.Namespace), backendRefKind, string(backendRef.Name), err)
+			} else {
+				for _, endpointSlice := range endpointSliceList.Items {
+					endpointSlice := endpointSlice
+					loggers.LoggerAPKOperator.Infof("Added EndpointSlice to resource tree namespace %s, name %s",
+						endpointSlice.Namespace, endpointSlice.Name)
+					gwcResource.EndpointSlices = append(gwcResource.EndpointSlices, &endpointSlice)
+				}
+			}
+		}
+	}
+}
+
+func (r *gatewayReconcilerNew) getNamespace(ctx context.Context, name string) (*corev1.Namespace, error) {
+	nsKey := types.NamespacedName{Name: name}
+	ns := new(corev1.Namespace)
+	if err := r.client.Get(ctx, nsKey, ns); err != nil {
+		loggers.LoggerAPKOperator.Error("Unable to get Namespace ", err)
+		return nil, err
+	}
+	return ns, nil
+}
+
+func (r *gatewayReconcilerNew) updateStatusForGatewayClass(
+	ctx context.Context,
+	gc *gwapiv1.GatewayClass,
+	accepted bool,
+	reason,
+	msg string) error {
+	if r.statusUpdater != nil {
+		r.statusUpdater.Send(status.Update{
+			NamespacedName: types.NamespacedName{Name: gc.Name},
+			Resource:       &gwapiv1.GatewayClass{},
+			UpdateStatus: func(obj client.Object) client.Object {
+				gc, ok := obj.(*gwapiv1.GatewayClass)
+				if !ok {
+					panic(fmt.Sprintf("unsupported object type %T", obj))
+				}
+
+				return status.SetGatewayClassAccepted(gc.DeepCopy(), accepted, reason, msg)
+			},
+		})
+	} else {
+		// this branch makes testing easier by not going through the status.Updater.
+		duplicate := status.SetGatewayClassAccepted(gc.DeepCopy(), accepted, reason, msg)
+
+		if err := r.client.Status().Update(ctx, duplicate); err != nil && !k8errors.IsNotFound(err) {
+			return fmt.Errorf("error updating status of gatewayclass %s: %w", duplicate.Name, err)
+		}
+	}
+	return nil
+}
+
+// removeFinalizer removes the gatewayclass finalizer from the provided gc, if it exists.
+func (r *gatewayReconcilerNew) removeFinalizer(ctx context.Context, gc *gwapiv1.GatewayClass) error {
+	if stringutils.StringInSlice(gatewayClassFinalizer, gc.Finalizers) {
+		base := client.MergeFrom(gc.DeepCopy())
+		gc.Finalizers = stringutils.RemoveString(gc.Finalizers, gatewayClassFinalizer)
+		if err := r.client.Patch(ctx, gc, base); err != nil {
+			return fmt.Errorf("failed to remove finalizer from gatewayclass %s: %w", gc.Name, err)
+		}
+	}
+	return nil
+}
+
+// addFinalizer adds the gatewayclass finalizer to the provided gc, if it doesn't exist.
+func (r *gatewayReconcilerNew) addFinalizer(ctx context.Context, gc *gwapiv1.GatewayClass) error {
+	if !stringutils.StringInSlice(gatewayClassFinalizer, gc.Finalizers) {
+		base := client.MergeFrom(gc.DeepCopy())
+		gc.Finalizers = append(gc.Finalizers, gatewayClassFinalizer)
+		if err := r.client.Patch(ctx, gc, base); err != nil {
+			return fmt.Errorf("failed to add finalizer to gatewayclass %s: %w", gc.Name, err)
+		}
+	}
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go b/adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go
new file mode 100644
index 000000000..c31d2dc4e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go
@@ -0,0 +1,151 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+package kubernetes
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/operator/constants"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+type controlledClasses struct {
+	// matchedClasses holds all GatewayClass objects with matching controllerName.
+	matchedClasses []*gwapiv1.GatewayClass
+}
+
+func (cc *controlledClasses) addMatch(gc *gwapiv1.GatewayClass) {
+	cc.matchedClasses = append(cc.matchedClasses, gc)
+}
+
+func (cc *controlledClasses) removeMatch(gc *gwapiv1.GatewayClass) {
+	// First remove gc from matchedClasses.
+	for i, matchedGC := range cc.matchedClasses {
+		if matchedGC.Name == gc.Name {
+			cc.matchedClasses[i] = cc.matchedClasses[len(cc.matchedClasses)-1]
+			cc.matchedClasses = cc.matchedClasses[:len(cc.matchedClasses)-1]
+			break
+		}
+	}
+}
+
+// terminatesTLS returns true if the provided gateway contains a listener configured
+// for TLS termination.
+func terminatesTLS(listener *gwapiv1.Listener) bool {
+	if listener.TLS != nil &&
+		(listener.Protocol == gwapiv1.HTTPSProtocolType ||
+			listener.Protocol == gwapiv1.TLSProtocolType) &&
+		listener.TLS.Mode != nil &&
+		*listener.TLS.Mode == gwapiv1.TLSModeTerminate {
+		return true
+	}
+	return false
+}
+
+// refsSecret returns true if ref refers to a Secret.
+func refsSecret(ref *gwapiv1.SecretObjectReference) bool {
+	return (ref.Group == nil || *ref.Group == corev1.GroupName) &&
+		(ref.Kind == nil || *ref.Kind == gatewayapi.KindSecret)
+}
+
+type ObjectKindNamespacedName struct {
+	kind      string
+	namespace string
+	name      string
+}
+
+// validateParentRefs validates the provided routeParentReferences, returning the
+// referenced Gateways managed by Envoy Gateway. The only supported parentRef
+// is a Gateway.
+func validateParentRefs(ctx context.Context, client client.Client, namespace string,
+	gatewayClassController gwapiv1.GatewayController,
+	routeParentReferences []gwapiv1.ParentReference) ([]gwapiv1.Gateway, error) {
+
+	var gateways []gwapiv1.Gateway
+	for i := range routeParentReferences {
+		ref := routeParentReferences[i]
+		if ref.Kind != nil && *ref.Kind != "Gateway" {
+			return nil, fmt.Errorf("invalid Kind %q", *ref.Kind)
+		}
+		if ref.Group != nil && *ref.Group != gwapiv1.GroupName {
+			return nil, fmt.Errorf("invalid Group %q", *ref.Group)
+		}
+
+		// Ensure the referenced Gateway exists, using the route's namespace unless
+		// specified by the parentRef.
+		ns := namespace
+		if ref.Namespace != nil {
+			ns = string(*ref.Namespace)
+		}
+		gwKey := types.NamespacedName{
+			Namespace: ns,
+			Name:      string(ref.Name),
+		}
+
+		gw := new(gwapiv1.Gateway)
+		if err := client.Get(ctx, gwKey, gw); err != nil {
+			return nil, fmt.Errorf("failed to get gateway %s/%s: %w", gwKey.Namespace, gwKey.Name, err)
+		}
+
+		gcKey := types.NamespacedName{Name: string(gw.Spec.GatewayClassName)}
+		gc := new(gwapiv1.GatewayClass)
+		if err := client.Get(ctx, gcKey, gc); err != nil {
+			return nil, fmt.Errorf("failed to get gatewayclass %s: %w", gcKey.Name, err)
+		}
+		if gc.Spec.ControllerName == gatewayClassController {
+			gateways = append(gateways, *gw)
+		}
+	}
+
+	return gateways, nil
+}
+
+// validateBackendRef validates that ref is a reference to a local Service.
+// TODO: Add support for:
+//   - Validating weights.
+//   - Validating ports.
+//   - Referencing HTTPRoutes.
+func validateBackendRef(ref *gwapiv1.BackendRef) error {
+	switch {
+	case ref == nil:
+		return nil
+	case gatewayapi.GroupDerefOr(ref.Group, corev1.GroupName) != corev1.GroupName && gatewayapi.GroupDerefOr(ref.Group, corev1.GroupName) != constants.GroupName:
+		return fmt.Errorf("invalid group; must be nil, empty string or %q, given %q", constants.GroupName, gatewayapi.GroupDerefOr(ref.Group, corev1.GroupName))
+	case gatewayapi.KindDerefOr(ref.Kind, gatewayapi.KindService) != gatewayapi.KindService && gatewayapi.KindDerefOr(ref.Kind, gatewayapi.KindService) != constants.KindBackend:
+		return fmt.Errorf("invalid kind %q; must be %q or %q, given %q",
+			*ref.BackendObjectReference.Kind, gatewayapi.KindService, constants.KindBackend, gatewayapi.GroupDerefOr(ref.Group, corev1.GroupName))
+	}
+
+	return nil
+}
+
+// infraName returns expected name for the EnvoyProxy infra resources.
+// By default it returns hashed string from {GatewayNamespace}/{GatewayName},
+func infraName(gateway *gwapiv1.Gateway) string {
+	namespace := gateway.Namespace
+	if len(namespace) > 5 {
+		namespace = namespace[:5]
+	}
+	infraName := fmt.Sprintf("%s/%s", namespace, gateway.Name)
+	return proxy.ExpectedResourceHashedName(infraName)
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go b/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
new file mode 100644
index 000000000..620c75089
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
@@ -0,0 +1,399 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+const (
+	classGatewayIndex          = "classGatewayIndex"
+	gatewayTLSRouteIndex       = "gatewayTLSRouteIndex"
+	gatewayHTTPRouteIndex      = "gatewayHTTPRouteIndex"
+	gatewayGRPCRouteIndex      = "gatewayGRPCRouteIndex"
+	gatewayTCPRouteIndex       = "gatewayTCPRouteIndex"
+	gatewayUDPRouteIndex       = "gatewayUDPRouteIndex"
+	secretGatewayIndex         = "secretGatewayIndex"
+	targetRefGrantRouteIndex   = "targetRefGrantRouteIndex"
+	backendHTTPRouteIndex      = "backendHTTPRouteIndex"
+	serviceHTTPRouteIndex      = "serviceHTTPRouteIndex"
+	backendGRPCRouteIndex      = "backendGRPCRouteIndex"
+	backendTLSRouteIndex       = "backendTLSRouteIndex"
+	backendTCPRouteIndex       = "backendTCPRouteIndex"
+	backendUDPRouteIndex       = "backendUDPRouteIndex"
+	secretSecurityPolicyIndex  = "secretSecurityPolicyIndex"
+	backendSecurityPolicyIndex = "backendSecurityPolicyIndex"
+	configMapCtpIndex          = "configMapCtpIndex"
+	secretCtpIndex             = "secretCtpIndex"
+	configMapBtlsIndex         = "configMapBtlsIndex"
+)
+
+func addReferenceGrantIndexers(ctx context.Context, mgr manager.Manager) error {
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1b1.ReferenceGrant{}, targetRefGrantRouteIndex, func(rawObj client.Object) []string {
+		refGrant := rawObj.(*gwapiv1b1.ReferenceGrant)
+		var referredServices []string
+		for _, target := range refGrant.Spec.To {
+			referredServices = append(referredServices, string(target.Kind))
+		}
+		return referredServices
+	})
+}
+
+// addHTTPRouteIndexers adds indexing on HTTPRoute.
+//   - For Service, ServiceImports objects that are referenced in HTTPRoute objects via `.spec.rules.backendRefs`.
+//     This helps in querying for HTTPRoutes that are affected by a particular Service CRUD.
+func addHTTPRouteIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.HTTPRoute{}, gatewayHTTPRouteIndex, gatewayHTTPRouteIndexFunc); err != nil {
+		return err
+	}
+	// Backend to HTTPRoute indexer
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.HTTPRoute{}, backendHTTPRouteIndex, backendHTTPRouteIndexFunc); err != nil {
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.HTTPRoute{}, serviceHTTPRouteIndex, serviceHTTPRouteIndexFunc)
+}
+
+func gatewayHTTPRouteIndexFunc(rawObj client.Object) []string {
+	httproute := rawObj.(*gwapiv1.HTTPRoute)
+	var gateways []string
+	for _, parent := range httproute.Spec.ParentRefs {
+		if parent.Kind == nil || string(*parent.Kind) == gatewayapi.KindGateway {
+			// If an explicit Gateway namespace is not provided, use the HTTPRoute namespace to
+			// lookup the provided Gateway Name.
+			gateways = append(gateways,
+				types.NamespacedName{
+					Namespace: gatewayapi.NamespaceDerefOr(parent.Namespace, httproute.Namespace),
+					Name:      string(parent.Name),
+				}.String(),
+			)
+		}
+	}
+	return gateways
+}
+
+func serviceHTTPRouteIndexFunc(rawObj client.Object) []string {
+	httproute := rawObj.(*gwapiv1.HTTPRoute)
+	var backendRefs []string
+	for _, rule := range httproute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindService {
+				// If an explicit Backend namespace is not provided, use the HTTPRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOr(backend.Namespace, httproute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+func backendHTTPRouteIndexFunc(rawObj client.Object) []string {
+	httproute := rawObj.(*gwapiv1.HTTPRoute)
+	var backendRefs []string
+	for _, rule := range httproute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindBackend {
+				// If an explicit Backend namespace is not provided, use the HTTPRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOr(backend.Namespace, httproute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+// addGRPCRouteIndexers adds indexing on GRPCRoute, for Service objects that are
+// referenced in GRPCRoute objects via `.spec.rules.backendRefs`. This helps in
+// querying for GRPCRoutes that are affected by a particular Service CRUD.
+func addGRPCRouteIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.GRPCRoute{}, gatewayGRPCRouteIndex, gatewayGRPCRouteIndexFunc); err != nil {
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.GRPCRoute{}, backendGRPCRouteIndex, backendGRPCRouteIndexFunc)
+}
+
+func gatewayGRPCRouteIndexFunc(rawObj client.Object) []string {
+	grpcroute := rawObj.(*gwapiv1a2.GRPCRoute)
+	var gateways []string
+	for _, parent := range grpcroute.Spec.ParentRefs {
+		if parent.Kind == nil || string(*parent.Kind) == gatewayapi.KindGateway {
+			// If an explicit Gateway namespace is not provided, use the GRPCRoute namespace to
+			// lookup the provided Gateway Name.
+			gateways = append(gateways,
+				types.NamespacedName{
+					Namespace: gatewayapi.NamespaceDerefOr(parent.Namespace, grpcroute.Namespace),
+					Name:      string(parent.Name),
+				}.String(),
+			)
+		}
+	}
+	return gateways
+}
+
+func backendGRPCRouteIndexFunc(rawObj client.Object) []string {
+	grpcroute := rawObj.(*gwapiv1a2.GRPCRoute)
+	var backendRefs []string
+	for _, rule := range grpcroute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindService {
+				// If an explicit Backend namespace is not provided, use the GRPCRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOr(backend.Namespace, grpcroute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+// addTLSRouteIndexers adds indexing on TLSRoute, for Service objects that are
+// referenced in TLSRoute objects via `.spec.rules.backendRefs`. This helps in
+// querying for TLSRoutes that are affected by a particular Service CRUD.
+func addTLSRouteIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.TLSRoute{}, gatewayTLSRouteIndex, func(rawObj client.Object) []string {
+		tlsRoute := rawObj.(*gwapiv1a2.TLSRoute)
+		var gateways []string
+		for _, parent := range tlsRoute.Spec.ParentRefs {
+			if string(*parent.Kind) == gatewayapi.KindGateway {
+				// If an explicit Gateway namespace is not provided, use the TLSRoute namespace to
+				// lookup the provided Gateway Name.
+				gateways = append(gateways,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(parent.Namespace, tlsRoute.Namespace),
+						Name:      string(parent.Name),
+					}.String(),
+				)
+			}
+		}
+		return gateways
+	}); err != nil {
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.TLSRoute{}, backendTLSRouteIndex, backendTLSRouteIndexFunc)
+}
+
+func backendTLSRouteIndexFunc(rawObj client.Object) []string {
+	tlsroute := rawObj.(*gwapiv1a2.TLSRoute)
+	var backendRefs []string
+	for _, rule := range tlsroute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindService {
+				// If an explicit Backend namespace is not provided, use the TLSRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(backend.Namespace, tlsroute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+// addTCPRouteIndexers adds indexing on TCPRoute, for Service objects that are
+// referenced in TCPRoute objects via `.spec.rules.backendRefs`. This helps in
+// querying for TCPRoutes that are affected by a particular Service CRUD.
+func addTCPRouteIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.TCPRoute{}, gatewayTCPRouteIndex, func(rawObj client.Object) []string {
+		tcpRoute := rawObj.(*gwapiv1a2.TCPRoute)
+		var gateways []string
+		for _, parent := range tcpRoute.Spec.ParentRefs {
+			if string(*parent.Kind) == gatewayapi.KindGateway {
+				// If an explicit Gateway namespace is not provided, use the TCPRoute namespace to
+				// lookup the provided Gateway Name.
+				gateways = append(gateways,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(parent.Namespace, tcpRoute.Namespace),
+						Name:      string(parent.Name),
+					}.String(),
+				)
+			}
+		}
+		return gateways
+	}); err != nil {
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.TCPRoute{}, backendTCPRouteIndex, backendTCPRouteIndexFunc)
+}
+
+func backendTCPRouteIndexFunc(rawObj client.Object) []string {
+	tcpRoute := rawObj.(*gwapiv1a2.TCPRoute)
+	var backendRefs []string
+	for _, rule := range tcpRoute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindService {
+				// If an explicit Backend namespace is not provided, use the TCPRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(backend.Namespace, tcpRoute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+// addUDPRouteIndexers adds indexing on UDPRoute.
+//   - For Gateway objects that are referenced in UDPRoute objects via `.spec.parentRefs`. This helps in
+//     querying for UDPRoutes that are affected by a particular Gateway CRUD.
+//   - For Service objects that are referenced in UDPRoute objects via `.spec.rules.backendRefs`. This helps in
+//     querying for UDPRoutes that are affected by a particular Service CRUD.
+func addUDPRouteIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.UDPRoute{}, gatewayUDPRouteIndex, func(rawObj client.Object) []string {
+		udpRoute := rawObj.(*gwapiv1a2.UDPRoute)
+		var gateways []string
+		for _, parent := range udpRoute.Spec.ParentRefs {
+			if string(*parent.Kind) == gatewayapi.KindGateway {
+				// If an explicit Gateway namespace is not provided, use the UDPRoute namespace to
+				// lookup the provided Gateway Name.
+				gateways = append(gateways,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(parent.Namespace, udpRoute.Namespace),
+						Name:      string(parent.Name),
+					}.String(),
+				)
+			}
+		}
+		return gateways
+	}); err != nil {
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.UDPRoute{}, backendUDPRouteIndex, backendUDPRouteIndexFunc)
+}
+
+func backendUDPRouteIndexFunc(rawObj client.Object) []string {
+	udproute := rawObj.(*gwapiv1a2.UDPRoute)
+	var backendRefs []string
+	for _, rule := range udproute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindService {
+				// If an explicit Backend namespace is not provided, use the UDPRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(backend.Namespace, udproute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+// addGatewayIndexers adds indexing on Gateway, for Secret objects and gatewayclass that are
+// referenced in Gateway objects. This helps in querying for Gateways that are
+// affected by a particular Secret CRUD.
+func addGatewayIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.Gateway{}, secretGatewayIndex, secretGatewayIndexFunc); err != nil {
+		loggers.LoggerAPKOperator.Errorf("Error while adding index %s, %v ", secretGatewayIndex, err)
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.Gateway{}, classGatewayIndex, func(rawObj client.Object) []string {
+		gateway := rawObj.(*gwapiv1.Gateway)
+		loggers.LoggerAPKOperator.Infof("Index %s added for %s:%s to %s", classGatewayIndex, gateway.Namespace, gateway.Name,
+			gateway.Spec.GatewayClassName)
+		return []string{string(gateway.Spec.GatewayClassName)}
+	})
+}
+
+func secretGatewayIndexFunc(rawObj client.Object) []string {
+	gateway := rawObj.(*gwapiv1.Gateway)
+	var secretReferences []string
+	for _, listener := range gateway.Spec.Listeners {
+		if listener.TLS == nil || *listener.TLS.Mode != gwapiv1.TLSModeTerminate {
+			continue
+		}
+		for _, cert := range listener.TLS.CertificateRefs {
+			if *cert.Kind == gatewayapi.KindSecret {
+				// If an explicit Secret namespace is not provided, use the Gateway namespace to
+				// lookup the provided Secret Name.
+				secretReferences = append(secretReferences,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOr(cert.Namespace, gateway.Namespace),
+						Name:      string(cert.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return secretReferences
+}
+
+// addBtlsIndexers adds indexing on BackendTLSPolicy, for ConfigMap objects that are
+// referenced in BackendTLSPolicy objects. This helps in querying for BackendTLSPolicies that are
+// affected by a particular ConfigMap CRUD.
+func addBtlsIndexers(ctx context.Context, mgr manager.Manager) error {
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.BackendTLSPolicy{}, configMapBtlsIndex, configMapBtlsIndexFunc)
+}
+
+func configMapBtlsIndexFunc(rawObj client.Object) []string {
+	btls := rawObj.(*gwapiv1a2.BackendTLSPolicy)
+	var configMapReferences []string
+	if btls.Spec.TLS.CACertRefs != nil {
+		for _, caCertRef := range btls.Spec.TLS.CACertRefs {
+			if string(caCertRef.Kind) == gatewayapi.KindConfigMap {
+				configMapReferences = append(configMapReferences,
+					types.NamespacedName{
+						Namespace: btls.Namespace,
+						Name:      string(caCertRef.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return configMapReferences
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
new file mode 100644
index 000000000..d72604230
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
@@ -0,0 +1,112 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"flag"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/provider"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/operator/status"
+	"k8s.io/client-go/rest"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+)
+
+// Provider is the scaffolding for the Kubernetes provider. It sets up dependencies
+// and defines the topology of the provider and its managed components, wiring
+// them together.
+type Provider struct {
+	client  client.Client
+	manager manager.Manager
+}
+
+// New creates a new Provider from the provided EnvoyGateway.
+func New(cfg *rest.Config, resources *message.ProviderResources) (*Provider, error) {
+	opts := zap.Options{
+		Development: true,
+	}
+	opts.BindFlags(flag.CommandLine)
+	flag.Parse()
+	log.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
+
+	// TODO: Decide which mgr opts should be exposed through envoygateway.provider.kubernetes API.
+	mgrOpts := manager.Options{
+		LeaderElection:         false,
+		Scheme:                 provider.GetScheme(),
+		HealthProbeBindAddress: ":8081",
+		LeaderElectionID:       "operator-lease.apk.wso2.com",
+	}
+
+	mgr, err := ctrl.NewManager(cfg, mgrOpts)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create manager: %w", err)
+	}
+
+	updateHandler := status.NewUpdateHandler(mgr.GetClient())
+	if err := mgr.Add(updateHandler); err != nil {
+		return nil, fmt.Errorf("failed to add status update handler %w", err)
+	}
+
+	// Create and register the controllers with the manager.
+	if err := InitGatewayController(mgr, resources, updateHandler); err != nil {
+		return nil, fmt.Errorf("failted to create gatewayapi controller: %w", err)
+	}
+
+	// Add health check health probes.
+	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
+		return nil, fmt.Errorf("unable to set up health check: %w", err)
+	}
+
+	// Add ready check health probes.
+	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
+		return nil, fmt.Errorf("unable to set up ready check: %w", err)
+	}
+
+	return &Provider{
+		manager: mgr,
+		client:  mgr.GetClient(),
+	}, nil
+}
+
+// Start starts the Provider synchronously until a message is received from ctx.
+func (p *Provider) Start(ctx context.Context) error {
+	errChan := make(chan error)
+	go func() {
+		errChan <- p.manager.Start(ctx)
+	}()
+
+	// Wait for the manager to exit or an explicit stop.
+	select {
+	case <-ctx.Done():
+		return nil
+	case err := <-errChan:
+		return err
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
new file mode 100644
index 000000000..156fb9f3b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
@@ -0,0 +1,262 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+
+	appsv1 "k8s.io/api/apps/v1"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	corev1 "k8s.io/api/core/v1"
+	k8errors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// hasMatchingController returns true if the provided object is a GatewayClass
+// with a Spec.Controller string matching this Envoy Gateway's controller string,
+// or false otherwise.
+func (r *gatewayReconcilerNew) hasMatchingController(obj client.Object) bool {
+	gc, ok := obj.(*gwapiv1.GatewayClass)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("bypassing reconciliation due to unexpected object type ", obj)
+		return false
+	}
+
+	if gc.Spec.ControllerName == gatewayClassControllerName {
+		loggers.LoggerAPKOperator.Infof("gatewayclass has matching controller name %s, hence processing",
+			gc.Name)
+		return true
+	}
+
+	loggers.LoggerAPKOperator.Info("bypassing reconciliation due to controller name",
+		gc.Spec.ControllerName)
+	return false
+}
+
+// validateGatewayForReconcile returns true if the provided object is a Gateway
+// using a GatewayClass matching the configured gatewayclass controller name.
+func (r *gatewayReconcilerNew) validateGatewayForReconcile(obj client.Object) bool {
+	gw, ok := obj.(*gwapiv1.Gateway)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation object", obj)
+		return false
+	}
+
+	gatewayClass := &gwapiv1.GatewayClass{}
+	key := types.NamespacedName{Name: string(gw.Spec.GatewayClassName)}
+	if err := r.client.Get(context.Background(), key, gatewayClass); err != nil {
+		loggers.LoggerAPKOperator.Errorf("failed to get gatewayclass name %s, %+v", gw.Spec.GatewayClassName, err)
+		return false
+	}
+
+	if gatewayClass.Spec.ControllerName != gatewayClassControllerName {
+		loggers.LoggerAPKOperator.Infof("gatewayclass name %s for gateway doesn't match configured name %s in %s/%s ",
+			string(gatewayClass.Spec.ControllerName), gatewayClassControllerName, gw.Namespace, gw.Name)
+		return false
+	}
+	loggers.LoggerAPKOperator.Info("Gateway CR change is detected for ", gw.Name)
+	return true
+}
+
+// validateServiceForReconcile tries finding the owning Gateway of the Service
+// if it exists, finds the Gateway's Deployment, and further updates the Gateway
+// status Ready condition. All Services are pushed for reconciliation.
+func (r *gatewayReconcilerNew) validateServiceForReconcile(obj client.Object) bool {
+	ctx := context.Background()
+	svc, ok := obj.(*corev1.Service)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation for object", obj)
+		return false
+	}
+	labels := svc.GetLabels()
+
+	// Check if the Service belongs to a Gateway, if so, update the Gateway status.
+	gtw := r.findOwningGateway(ctx, labels)
+	if gtw != nil {
+		r.updateStatusForGateway(ctx, gtw)
+		return false
+	}
+
+	nsName := utils.NamespacedName(svc)
+	return r.isRouteReferencingBackend(&nsName)
+
+}
+
+// findOwningGateway attempts finds a Gateway using "labels".
+func (r *gatewayReconcilerNew) findOwningGateway(ctx context.Context, labels map[string]string) *gwapiv1.Gateway {
+	gwName, ok := labels[gatewayapi.OwningGatewayNameLabel]
+	if !ok {
+		return nil
+	}
+
+	gwNamespace, ok := labels[gatewayapi.OwningGatewayNamespaceLabel]
+	if !ok {
+		return nil
+	}
+
+	gatewayKey := types.NamespacedName{Namespace: gwNamespace, Name: gwName}
+	gtw := new(gwapiv1.Gateway)
+	if err := r.client.Get(ctx, gatewayKey, gtw); err != nil {
+		loggers.LoggerAPKOperator.Infof("Gateway %+v not found : %v", gatewayKey, err)
+		return nil
+	}
+	return gtw
+}
+
+// isRouteReferencingBackend returns true if the backend(service and serviceImport) is referenced by any of the xRoutes
+// in the system, else returns false.
+func (r *gatewayReconcilerNew) isRouteReferencingBackend(nsName *types.NamespacedName) bool {
+	ctx := context.Background()
+	httpRouteList := &gwapiv1.HTTPRouteList{}
+	if err := r.client.List(ctx, httpRouteList, &client.ListOptions{
+		FieldSelector: fields.OneTermEqualSelector(serviceHTTPRouteIndex, nsName.String()),
+	}); err != nil {
+		loggers.LoggerAPKOperator.Error("unable to find associated HTTPRoutes for the service ", err)
+		return false
+	}
+
+	// Check how many Route objects refer this Backend
+	allAssociatedRoutes := len(httpRouteList.Items)
+
+	return allAssociatedRoutes != 0
+}
+
+// envoyServiceForGateway returns the Envoy service, returning nil if the service doesn't exist.
+func (r *gatewayReconcilerNew) envoyServiceForGateway(ctx context.Context, gateway *gwapiv1.Gateway) (*corev1.Service, error) {
+	key := types.NamespacedName{
+		Namespace: r.namespace,
+		Name:      infraName(gateway),
+	}
+	svc := new(corev1.Service)
+	if err := r.client.Get(ctx, key, svc); err != nil {
+		if k8errors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return svc, nil
+}
+
+// envoyDeploymentForGateway returns the Envoy Deployment, returning nil if the Deployment doesn't exist.
+func (r *gatewayReconcilerNew) envoyDeploymentForGateway(ctx context.Context, gateway *gwapiv1.Gateway) (*appsv1.Deployment, error) {
+	key := types.NamespacedName{
+		Namespace: r.namespace,
+		Name:      infraName(gateway),
+	}
+	deployment := new(appsv1.Deployment)
+	if err := r.client.Get(ctx, key, deployment); err != nil {
+		if k8errors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return deployment, nil
+}
+
+func (r *gatewayReconcilerNew) handleNode(obj client.Object) bool {
+	ctx := context.Background()
+	node, ok := obj.(*corev1.Node)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation", obj)
+		return false
+	}
+
+	key := types.NamespacedName{Name: node.Name}
+	if err := r.client.Get(ctx, key, node); err != nil {
+		if k8errors.IsNotFound(err) {
+			r.store.removeNode(node)
+			return true
+		}
+		loggers.LoggerAPKOperator.Error(err, "unable to find node ", node.Name)
+		return false
+	}
+
+	r.store.addNode(node)
+	return true
+}
+
+// validateSecretForReconcile checks whether the Secret belongs to a valid Gateway.
+func (r *gatewayReconcilerNew) validateSecretForReconcile(obj client.Object) bool {
+	secret, ok := obj.(*corev1.Secret)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation", obj)
+		return false
+	}
+
+	nsName := utils.NamespacedName(secret)
+
+	if r.isGatewayReferencingSecret(&nsName) {
+		return true
+	}
+
+	return false
+}
+
+func (r *gatewayReconcilerNew) isGatewayReferencingSecret(nsName *types.NamespacedName) bool {
+	gwList := &gwapiv1.GatewayList{}
+	if err := r.client.List(context.Background(), gwList, &client.ListOptions{
+		FieldSelector: fields.OneTermEqualSelector(secretGatewayIndex, nsName.String()),
+	}); err != nil {
+		loggers.LoggerAPKOperator.Error(err, "unable to find associated Gateways")
+		return false
+	}
+
+	if len(gwList.Items) == 0 {
+		return false
+	}
+
+	for _, gw := range gwList.Items {
+		gw := gw
+		if !r.validateGatewayForReconcile(&gw) {
+			return false
+		}
+	}
+	return true
+}
+
+// validateDeploymentForReconcile tries finding the owning Gateway of the Deployment
+// if it exists, finds the Gateway's Service, and further updates the Gateway
+// status Ready condition. No Deployments are pushed for reconciliation.
+func (r *gatewayReconcilerNew) validateDeploymentForReconcile(obj client.Object) bool {
+	ctx := context.Background()
+	deployment, ok := obj.(*appsv1.Deployment)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation", obj)
+		return false
+	}
+	labels := deployment.GetLabels()
+
+	// Only deployments in the configured namespace should be reconciled.
+	if deployment.Namespace == r.namespace {
+		// Check if the deployment belongs to a Gateway, if so, update the Gateway status.
+		gtw := r.findOwningGateway(ctx, labels)
+		if gtw != nil {
+			r.updateStatusForGateway(ctx, gtw)
+			return false
+		}
+	}
+
+	// There is no need to reconcile the Deployment any further.
+	return false
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates_test.go b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates_test.go
new file mode 100644
index 000000000..3b405680e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates_test.go
@@ -0,0 +1,89 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package kubernetes
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+type GroupKindNamespacedName struct {
+	Group     gwapiv1.Group
+	Kind      gwapiv1.Kind
+	Namespace gwapiv1.Namespace
+	Name      gwapiv1.ObjectName
+}
+
+// TestGatewayClassHasMatchingController tests the hasMatchingController
+// predicate function.
+func TestGatewayClassHasMatchingController(t *testing.T) {
+	testCases := []struct {
+		name   string
+		obj    client.Object
+		client client.Client
+		expect bool
+	}{
+		{
+			name:   "matching controller name",
+			obj:    GetGatewayClass("test-gc", gatewayClassControllerName, nil),
+			expect: true,
+		},
+		{
+			name:   "non-matching controller name",
+			obj:    GetGatewayClass("test-gc", "not.configured/controller", nil),
+			expect: false,
+		},
+	}
+
+	r := gatewayReconcilerNew{}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			res := r.hasMatchingController(tc.obj)
+			require.Equal(t, tc.expect, res)
+		})
+	}
+}
+
+// GetGatewayClass returns a sample GatewayClass.
+func GetGatewayClass(name string, controller gwapiv1.GatewayController, envoyProxy *GroupKindNamespacedName) *gwapiv1.GatewayClass {
+	gwc := &gwapiv1.GatewayClass{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Spec: gwapiv1.GatewayClassSpec{
+			ControllerName: controller,
+		},
+	}
+
+	if envoyProxy != nil {
+		gwc.Spec.ParametersRef = &gwapiv1.ParametersReference{
+			Group:     envoyProxy.Group,
+			Kind:      envoyProxy.Kind,
+			Name:      string(envoyProxy.Name),
+			Namespace: &envoyProxy.Namespace,
+		}
+	}
+
+	return gwc
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
new file mode 100644
index 000000000..c63353bf6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
@@ -0,0 +1,189 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"errors"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// processHTTPRoutes finds HTTPRoutes corresponding to a gatewayNamespaceName, further checks for
+// the backend references and pushes the HTTPRoutes to the resourceTree.
+func (r *gatewayReconcilerNew) processHTTPRoutes(ctx context.Context, gatewayNamespaceName string,
+	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources) error {
+	httpRouteList := &gwapiv1.HTTPRouteList{}
+
+	// extensionRefFilters, err := r.getExtensionRefFilters(ctx)
+	// if err != nil {
+	// 	return err
+	// }
+	// for i := range extensionRefFilters {
+	// 	filter := extensionRefFilters[i]
+	// 	resourceMap.extensionRefFilters[utils.NamespacedName(&filter)] = filter
+	// }
+
+	if err := r.client.List(ctx, httpRouteList, &client.ListOptions{
+		FieldSelector: fields.OneTermEqualSelector(gatewayHTTPRouteIndex, gatewayNamespaceName),
+	}); err != nil {
+		loggers.LoggerAPKOperator.Error("Failed to list HTTPRoutes", err)
+		return err
+	}
+
+	for _, httpRoute := range httpRouteList.Items {
+		loggers.LoggerAPKOperator.Infof("Processing HTTPRoute %s:%s", httpRoute.Namespace, httpRoute.Name)
+
+		for _, rule := range httpRoute.Spec.Rules {
+			for _, backendRef := range rule.BackendRefs {
+				backendRef := backendRef
+				if err := validateBackendRef(&backendRef.BackendRef); err != nil {
+					loggers.LoggerAPKOperator.Error("Invalid backendRef ", err)
+					continue
+				}
+
+				backendNamespace := gatewayapi.NamespaceDerefOr(backendRef.Namespace, httpRoute.Namespace)
+				resourceMap.allAssociatedBackendRefs[gwapiv1.BackendObjectReference{
+					Group:     backendRef.BackendObjectReference.Group,
+					Kind:      backendRef.BackendObjectReference.Kind,
+					Namespace: gatewayapi.NamespacePtrV1Alpha2(backendNamespace),
+					Name:      backendRef.Name,
+				}] = struct{}{}
+
+				if backendNamespace != httpRoute.Namespace {
+					from := ObjectKindNamespacedName{
+						kind:      gatewayapi.KindHTTPRoute,
+						namespace: httpRoute.Namespace,
+						name:      httpRoute.Name,
+					}
+					to := ObjectKindNamespacedName{
+						kind:      gatewayapi.KindDerefOr(backendRef.Kind, gatewayapi.KindService),
+						namespace: backendNamespace,
+						name:      string(backendRef.Name),
+					}
+					refGrant, err := r.findReferenceGrant(ctx, from, to)
+					switch {
+					case err != nil:
+						loggers.LoggerAPKOperator.Error("Failed to find ReferenceGrant", err)
+					case refGrant == nil:
+						loggers.LoggerAPKOperator.Infof("No matching ReferenceGrants found for kind %s:%s to %s:%s",
+							from.kind, from.namespace, to.kind, to.namespace)
+					default:
+						resourceTree.ReferenceGrants = append(resourceTree.ReferenceGrants, refGrant)
+						loggers.LoggerAPKOperator.Infof("Added ReferenceGrant to resource map %s:%s",
+							refGrant.Namespace, refGrant.Name)
+					}
+				}
+			}
+
+			for i := range rule.Filters {
+				filter := rule.Filters[i]
+
+				if err := gatewayapi.ValidateHTTPRouteFilter(&filter); err != nil {
+					loggers.LoggerAPKOperator.Errorf("Bypassing filter rule for index %v, %v", i, err)
+					continue
+				}
+
+				// Load in the backendRefs from any requestMirrorFilters on the HTTPRoute
+				if filter.Type == gwapiv1.HTTPRouteFilterRequestMirror {
+					// Make sure the config actually exists
+					mirrorFilter := filter.RequestMirror
+					if mirrorFilter == nil {
+						loggers.LoggerAPKOperator.Error(errors.New("invalid requestMirror filter"), "bypassing filter rule", "index", i)
+						continue
+					}
+
+					mirrorBackendObj := mirrorFilter.BackendRef
+					// Wrap the filter's BackendObjectReference into a BackendRef so we can use existing tooling to check it
+					weight := int32(1)
+					mirrorBackendRef := gwapiv1.BackendRef{
+						BackendObjectReference: mirrorBackendObj,
+						Weight:                 &weight,
+					}
+
+					if err := validateBackendRef(&mirrorBackendRef); err != nil {
+						loggers.LoggerAPKOperator.Error("Invalid backendRef ", err)
+						continue
+					}
+
+					backendNamespace := gatewayapi.NamespaceDerefOr(mirrorBackendRef.Namespace,
+						httpRoute.Namespace)
+					resourceMap.allAssociatedBackendRefs[gwapiv1.BackendObjectReference{
+						Group:     mirrorBackendRef.BackendObjectReference.Group,
+						Kind:      mirrorBackendRef.BackendObjectReference.Kind,
+						Namespace: gatewayapi.NamespacePtrV1Alpha2(backendNamespace),
+						Name:      mirrorBackendRef.Name,
+					}] = struct{}{}
+
+					if backendNamespace != httpRoute.Namespace {
+						from := ObjectKindNamespacedName{
+							kind:      gatewayapi.KindHTTPRoute,
+							namespace: httpRoute.Namespace,
+							name:      httpRoute.Name,
+						}
+						to := ObjectKindNamespacedName{
+							kind:      gatewayapi.KindDerefOr(mirrorBackendRef.Kind, gatewayapi.KindService),
+							namespace: backendNamespace,
+							name:      string(mirrorBackendRef.Name),
+						}
+						refGrant, err := r.findReferenceGrant(ctx, from, to)
+						switch {
+						case err != nil:
+							loggers.LoggerAPKOperator.Error("Failed to find ReferenceGrant", err)
+						case refGrant == nil:
+							loggers.LoggerAPKOperator.Infof("No matching ReferenceGrants found from %s:%s target %s:%s",
+								from.kind, from.namespace, to.kind, to.namespace)
+						default:
+							resourceTree.ReferenceGrants = append(resourceTree.ReferenceGrants, refGrant)
+							loggers.LoggerAPKOperator.Infof("Added ReferenceGrant to resource map %s:%s",
+								refGrant.Namespace, refGrant.Name)
+						}
+					}
+				} else if filter.Type == gwapiv1.HTTPRouteFilterExtensionRef {
+					// NOTE: filters must be in the same namespace as the HTTPRoute
+					// Check if it's a Kind managed by an extension and add to resourceTree
+					key := types.NamespacedName{
+						Namespace: httpRoute.Namespace,
+						Name:      string(filter.ExtensionRef.Name),
+					}
+					extRefFilter, ok := resourceMap.extensionRefFilters[key]
+					if !ok {
+						loggers.LoggerAPKOperator.Errorf("Filter not found; bypassing rule name %v for index %v",
+							filter.ExtensionRef.Name, i)
+						continue
+					}
+
+					resourceTree.ExtensionRefFilters = append(resourceTree.ExtensionRefFilters, extRefFilter)
+				}
+			}
+		}
+
+		resourceMap.allAssociatedNamespaces[httpRoute.Namespace] = struct{}{}
+		// Discard Status to reduce memory consumption in watchable
+		// It will be recomputed by the gateway-api layer
+		httpRoute.Status = gwapiv1.HTTPRouteStatus{}
+		resourceTree.HTTPRoutes = append(resourceTree.HTTPRoutes, &httpRoute)
+	}
+
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/status.go b/adapter/internal/operator/gateway-api/provider/kubernetes/status.go
new file mode 100644
index 000000000..f20ceb9b5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/status.go
@@ -0,0 +1,137 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/operator/status"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// subscribeAndUpdateStatus subscribes to gateway API object status updates and
+// writes it into the Kubernetes API Server.
+func (r *gatewayReconcilerNew) subscribeAndUpdateStatus(ctx context.Context) {
+	// Gateway object status updater
+	go func() {
+		message.HandleSubscription(
+			message.Metadata{Runner: "provider", Message: "gateway-status"},
+			r.resources.GatewayStatuses.Subscribe(ctx),
+			func(update message.Update[types.NamespacedName, *gwapiv1.GatewayStatus], errChan chan error) {
+				// skip delete updates.
+				if update.Delete {
+					return
+				}
+				// Get gateway object
+				gtw := new(gwapiv1.Gateway)
+				if err := r.client.Get(ctx, update.Key, gtw); err != nil {
+					loggers.LoggerAPKOperator.Error(err, "gateway not found", "namespace", gtw.Namespace, "name", gtw.Name)
+					errChan <- err
+					return
+				}
+				// Set the updated Status and call the status update
+				gtw.Status = *update.Value
+				r.updateStatusForGateway(ctx, gtw)
+			},
+		)
+		loggers.LoggerAPKOperator.Info("gateway status subscriber shutting down")
+	}()
+
+	// HTTPRoute object status updater
+	go func() {
+		message.HandleSubscription(
+			message.Metadata{Runner: "provider", Message: "httproute-status"},
+			r.resources.HTTPRouteStatuses.Subscribe(ctx),
+			func(update message.Update[types.NamespacedName, *gwapiv1.HTTPRouteStatus], errChan chan error) {
+				// skip delete updates.
+				if update.Delete {
+					return
+				}
+				key := update.Key
+				val := update.Value
+				r.statusUpdater.Send(status.Update{
+					NamespacedName: key,
+					Resource:       new(gwapiv1.HTTPRoute),
+					UpdateStatus: func(obj client.Object) client.Object {
+						h, ok := obj.(*gwapiv1.HTTPRoute)
+						if !ok {
+							err := fmt.Errorf("unsupported object type %T", obj)
+							errChan <- err
+							panic(err)
+						}
+						hCopy := h.DeepCopy()
+						hCopy.Status.Parents = val.Parents
+						return hCopy
+					},
+				})
+			},
+		)
+		loggers.LoggerAPKOperator.Info("HttpRoute status subscriber shutting down")
+	}()
+
+}
+
+func (r *gatewayReconcilerNew) updateStatusForGateway(ctx context.Context, gtw *gwapiv1.Gateway) {
+	// nil check for unit tests.
+	if r.statusUpdater == nil {
+		return
+	}
+
+	// Get deployment
+	deploy, err := r.envoyDeploymentForGateway(ctx, gtw)
+	if err != nil || deploy == nil {
+		loggers.LoggerAPKOperator.Infof("Failed to get Deployment for gateway %s/%s, %+v",
+			gtw.Namespace, gtw.Name, err)
+	}
+
+	// Get service
+	svc, err := r.envoyServiceForGateway(ctx, gtw)
+	if err != nil || svc == nil {
+		loggers.LoggerAPKOperator.Infof("Failed to get Service for gateway %s:%s, %+v",
+			gtw.Namespace, gtw.Name, err)
+	}
+	// update accepted condition
+	status.UpdateGatewayStatusAcceptedCondition(gtw, true)
+	// update address field and programmed condition
+	status.UpdateGatewayStatusProgrammedCondition(gtw, svc, deploy, r.store.listNodeAddresses()...)
+
+	key := utils.NamespacedName(gtw)
+
+	// publish status
+	r.statusUpdater.Send(status.Update{
+		NamespacedName: key,
+		Resource:       new(gwapiv1.Gateway),
+		UpdateStatus: func(obj client.Object) client.Object {
+			g, ok := obj.(*gwapiv1.Gateway)
+			if !ok {
+				panic(fmt.Sprintf("unsupported object type %T", obj))
+			}
+			gCopy := g.DeepCopy()
+			gCopy.Status.Conditions = gtw.Status.Conditions
+			gCopy.Status.Addresses = gtw.Status.Addresses
+			gCopy.Status.Listeners = gtw.Status.Listeners
+			return gCopy
+		},
+	})
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/store.go b/adapter/internal/operator/gateway-api/provider/kubernetes/store.go
new file mode 100644
index 000000000..ffc571852
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/store.go
@@ -0,0 +1,93 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"sync"
+
+	corev1 "k8s.io/api/core/v1"
+)
+
+type nodeDetails struct {
+	name    string
+	address string
+}
+
+// kubernetesProviderStore holds cached information for the kubernetes provider.
+type kubernetesProviderStore struct {
+	// nodes holds information required for updating Gateway status with the Node
+	// addresses, in case the Gateway is exposed on every Node of the cluster, using
+	// Service of type NodePort.
+	nodes map[string]nodeDetails
+	mu    sync.Mutex
+}
+
+func newProviderStore() *kubernetesProviderStore {
+	return &kubernetesProviderStore{
+		nodes: make(map[string]nodeDetails),
+	}
+}
+
+func (p *kubernetesProviderStore) addNode(n *corev1.Node) {
+	details := nodeDetails{name: n.Name}
+
+	var internalIP, externalIP string
+	for _, addr := range n.Status.Addresses {
+		if addr.Type == corev1.NodeExternalIP {
+			externalIP = addr.Address
+		}
+		if addr.Type == corev1.NodeInternalIP {
+			internalIP = addr.Address
+		}
+	}
+
+	// In certain scenarios (like in local KinD clusters), the Node
+	// externalIP is not provided, in that case we default back
+	// to the internalIP of the Node.
+	if externalIP != "" {
+		details.address = externalIP
+	} else if internalIP != "" {
+		details.address = internalIP
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.nodes[n.Name] = details
+}
+
+func (p *kubernetesProviderStore) removeNode(n *corev1.Node) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	delete(p.nodes, n.Name)
+}
+
+func (p *kubernetesProviderStore) listNodeAddresses() []string {
+	addrs := []string{}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	for _, n := range p.nodes {
+		if n.address != "" {
+			addrs = append(addrs, n.address)
+		}
+	}
+	return addrs
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/store_test.go b/adapter/internal/operator/gateway-api/provider/kubernetes/store_test.go
new file mode 100644
index 000000000..3dea80e26
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/store_test.go
@@ -0,0 +1,111 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	corev1 "k8s.io/api/core/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestNodeDetailsAddressStore(t *testing.T) {
+	store := newProviderStore()
+	testCases := []struct {
+		name              string
+		nodeObject        *corev1.Node
+		expectedAddresses []string
+	}{
+		{
+			name: "No node addresses",
+			nodeObject: &corev1.Node{
+				ObjectMeta: v1.ObjectMeta{Name: "node1"},
+				Status:     corev1.NodeStatus{Addresses: []corev1.NodeAddress{{}}},
+			},
+			expectedAddresses: []string{},
+		},
+		{
+			name: "only external address",
+			nodeObject: &corev1.Node{
+				ObjectMeta: v1.ObjectMeta{Name: "node1"},
+				Status: corev1.NodeStatus{Addresses: []corev1.NodeAddress{{
+					Address: "1.1.1.1",
+					Type:    corev1.NodeExternalIP,
+				}}},
+			},
+			expectedAddresses: []string{"1.1.1.1"},
+		},
+		{
+			name: "only internal address",
+			nodeObject: &corev1.Node{
+				ObjectMeta: v1.ObjectMeta{Name: "node1"},
+				Status: corev1.NodeStatus{Addresses: []corev1.NodeAddress{{
+					Address: "1.1.1.1",
+					Type:    corev1.NodeInternalIP,
+				}}},
+			},
+			expectedAddresses: []string{"1.1.1.1"},
+		},
+		{
+			name: "prefer external address",
+			nodeObject: &corev1.Node{
+				ObjectMeta: v1.ObjectMeta{Name: "node1"},
+				Status: corev1.NodeStatus{Addresses: []corev1.NodeAddress{
+					{
+						Address: "1.1.1.1",
+						Type:    corev1.NodeExternalIP,
+					},
+					{
+						Address: "2.2.2.2",
+						Type:    corev1.NodeInternalIP,
+					},
+				}},
+			},
+			expectedAddresses: []string{"1.1.1.1"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			store.addNode(tc.nodeObject)
+			assert.Equal(t, tc.expectedAddresses, store.listNodeAddresses())
+			store.removeNode(tc.nodeObject)
+		})
+	}
+}
+
+func TestRace(t *testing.T) {
+	s := newProviderStore()
+
+	go func() {
+		for {
+			s.addNode(&corev1.Node{
+				ObjectMeta: v1.ObjectMeta{Name: "node1"},
+				Status:     corev1.NodeStatus{Addresses: []corev1.NodeAddress{{}}},
+			})
+		}
+	}()
+
+	_ = s.listNodeAddresses()
+}
diff --git a/adapter/internal/operator/gateway-api/provider/scheme.go b/adapter/internal/operator/gateway-api/provider/scheme.go
new file mode 100644
index 000000000..ebbeb2631
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/scheme.go
@@ -0,0 +1,70 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package provider
+
+import (
+	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
+	"k8s.io/apimachinery/pkg/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+var (
+	// scheme contains all the API types necessary for the provider's dynamic
+	// clients to work. Any new non-core types must be added here.
+	//
+	// NOTE: The discovery mechanism used by the client doesn't automatically
+	// refresh, so only add types here that are guaranteed to exist before the
+	// provider starts.
+	scheme = runtime.NewScheme()
+)
+
+func init() {
+	if err := clientgoscheme.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+	// Add Gateway API types.
+	if err := gwapiv1.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+	if err := gwapiv1b1.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+	if err := gwapiv1a2.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+	if err := dpv1alpha1.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+	if err := dpv1alpha2.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+}
+
+// GetScheme returns a scheme with types supported by the Kubernetes provider.
+func GetScheme() *runtime.Scheme {
+	return scheme
+}
diff --git a/adapter/internal/operator/gateway-api/resource.go b/adapter/internal/operator/gateway-api/resource.go
new file mode 100644
index 000000000..7e407b0d3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/resource.go
@@ -0,0 +1,168 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"cmp"
+	"reflect"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	"golang.org/x/exp/slices"
+	v1 "k8s.io/api/core/v1"
+	discoveryv1 "k8s.io/api/discovery/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+type XdsIRMap map[string]*ir.Xds
+type InfraIRMap map[string]*ir.Infra
+
+// Resources holds the Gateway API and related
+// resources that the translators needs as inputs.
+// +k8s:deepcopy-gen=true
+type Resources struct {
+	// This field is only used for marshalling/unmarshalling purposes and is not used by
+	// the translator
+	GatewayClass        *gwapiv1.GatewayClass         `json:"gatewayClass,omitempty" yaml:"gatewayClass,omitempty"`
+	Gateways            []*gwapiv1.Gateway            `json:"gateways,omitempty" yaml:"gateways,omitempty"`
+	HTTPRoutes          []*gwapiv1.HTTPRoute          `json:"httpRoutes,omitempty" yaml:"httpRoutes,omitempty"`
+	GRPCRoutes          []*gwapiv1a2.GRPCRoute        `json:"grpcRoutes,omitempty" yaml:"grpcRoutes,omitempty"`
+	TLSRoutes           []*gwapiv1a2.TLSRoute         `json:"tlsRoutes,omitempty" yaml:"tlsRoutes,omitempty"`
+	TCPRoutes           []*gwapiv1a2.TCPRoute         `json:"tcpRoutes,omitempty" yaml:"tcpRoutes,omitempty"`
+	UDPRoutes           []*gwapiv1a2.UDPRoute         `json:"udpRoutes,omitempty" yaml:"udpRoutes,omitempty"`
+	ReferenceGrants     []*gwapiv1b1.ReferenceGrant   `json:"referenceGrants,omitempty" yaml:"referenceGrants,omitempty"`
+	Namespaces          []*v1.Namespace               `json:"namespaces,omitempty" yaml:"namespaces,omitempty"`
+	Services            []*v1.Service                 `json:"services,omitempty" yaml:"services,omitempty"`
+	Backends            []*dpv1alpha1.Backend         `json:"backends,omitempty" yaml:"backends,omitempty"`
+	EndpointSlices      []*discoveryv1.EndpointSlice  `json:"endpointSlices,omitempty" yaml:"endpointSlices,omitempty"`
+	Secrets             []*v1.Secret                  `json:"secrets,omitempty" yaml:"secrets,omitempty"`
+	ConfigMaps          []*v1.ConfigMap               `json:"configMaps,omitempty" yaml:"configMaps,omitempty"`
+	ExtensionRefFilters []unstructured.Unstructured   `json:"extensionRefFilters,omitempty" yaml:"extensionRefFilters,omitempty"`
+	BackendTLSPolicies  []*gwapiv1a2.BackendTLSPolicy `json:"backendTLSPolicies,omitempty" yaml:"backendTLSPolicies,omitempty"`
+}
+
+func NewResources() *Resources {
+	return &Resources{
+		Gateways:            []*gwapiv1.Gateway{},
+		HTTPRoutes:          []*gwapiv1.HTTPRoute{},
+		GRPCRoutes:          []*gwapiv1a2.GRPCRoute{},
+		TLSRoutes:           []*gwapiv1a2.TLSRoute{},
+		Services:            []*v1.Service{},
+		EndpointSlices:      []*discoveryv1.EndpointSlice{},
+		Secrets:             []*v1.Secret{},
+		ConfigMaps:          []*v1.ConfigMap{},
+		ReferenceGrants:     []*gwapiv1b1.ReferenceGrant{},
+		Namespaces:          []*v1.Namespace{},
+		ExtensionRefFilters: []unstructured.Unstructured{},
+		BackendTLSPolicies:  []*gwapiv1a2.BackendTLSPolicy{},
+	}
+}
+
+func (r *Resources) GetNamespace(name string) *v1.Namespace {
+	for _, ns := range r.Namespaces {
+		if ns.Name == name {
+			return ns
+		}
+	}
+
+	return nil
+}
+
+func (r *Resources) GetService(namespace, name string) *v1.Service {
+	for _, svc := range r.Services {
+		if svc.Namespace == namespace && svc.Name == name {
+			return svc
+		}
+	}
+
+	return nil
+}
+
+func (r *Resources) GetSecret(namespace, name string) *v1.Secret {
+	for _, secret := range r.Secrets {
+		if secret.Namespace == namespace && secret.Name == name {
+			return secret
+		}
+	}
+
+	return nil
+}
+
+func (r *Resources) GetConfigMap(namespace, name string) *v1.ConfigMap {
+	for _, configMap := range r.ConfigMaps {
+		if configMap.Namespace == namespace && configMap.Name == name {
+			return configMap
+		}
+	}
+
+	return nil
+}
+
+// ControllerResources holds all the GatewayAPI resources per GatewayClass
+type ControllerResources []*Resources
+
+// DeepCopy creates a new ControllerResources.
+// It is handwritten since the tooling was unable to copy into a new slice
+func (c *ControllerResources) DeepCopy() *ControllerResources {
+	if c == nil {
+		return nil
+	}
+	out := make(ControllerResources, len(*c))
+	copy(out, *c)
+	return &out
+}
+
+// Equal implements the Comparable interface used by watchable.DeepEqual to skip unnecessary updates.
+func (c *ControllerResources) Equal(y *ControllerResources) bool {
+	// Deep copy to avoid modifying the original ordering.
+	c = c.DeepCopy()
+	c.sort()
+	y = y.DeepCopy()
+	y.sort()
+	return reflect.DeepEqual(c, y)
+}
+
+func (c *ControllerResources) sort() {
+	slices.SortFunc(*c, func(c1, c2 *Resources) int {
+		return cmp.Compare(c1.GatewayClass.Name, c2.GatewayClass.Name)
+	})
+}
+
+func (r *Resources) GetEndpointSlicesForBackend(svcNamespace, svcName string, backendKind string) []*discoveryv1.EndpointSlice {
+	var endpointSlices []*discoveryv1.EndpointSlice
+	for _, endpointSlice := range r.EndpointSlices {
+		var backendSelectorLabel string
+		switch backendKind {
+		case KindService:
+			backendSelectorLabel = discoveryv1.LabelServiceName
+		}
+		if svcNamespace == endpointSlice.Namespace &&
+			endpointSlice.GetLabels()[backendSelectorLabel] == svcName {
+			endpointSlices = append(endpointSlices, endpointSlice)
+		}
+	}
+	return endpointSlices
+}
diff --git a/adapter/internal/operator/gateway-api/route.go b/adapter/internal/operator/gateway-api/route.go
new file mode 100644
index 000000000..2a12e3615
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/route.go
@@ -0,0 +1,1340 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/status"
+	"github.com/wso2/apk/adapter/pkg/utils/regex"
+	corev1 "k8s.io/api/core/v1"
+	discoveryv1 "k8s.io/api/discovery/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+const (
+	// Following the description in `timeout` section of https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto
+	// Request timeout, which is defined as Duration, specifies the upstream timeout for the route
+	// If not specified, the default is 15s
+	HTTPRequestTimeout = "15s"
+)
+
+var (
+	_                RoutesTranslator = (*Translator)(nil)
+	validServiceName                  = `(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*`
+	validMethodName                   = `[A-Za-z_][A-Za-z_0-9]*`
+)
+
+type RoutesTranslator interface {
+	ProcessHTTPRoutes(httpRoutes []*gwapiv1.HTTPRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*HTTPRouteContext
+	ProcessGRPCRoutes(grpcRoutes []*gwapiv1a2.GRPCRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*GRPCRouteContext
+	ProcessTLSRoutes(tlsRoutes []*gwapiv1a2.TLSRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*TLSRouteContext
+	ProcessTCPRoutes(tcpRoutes []*gwapiv1a2.TCPRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*TCPRouteContext
+	ProcessUDPRoutes(udpRoutes []*gwapiv1a2.UDPRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*UDPRouteContext
+}
+
+func (t *Translator) ProcessHTTPRoutes(httpRoutes []*gwapiv1.HTTPRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*HTTPRouteContext {
+	var relevantHTTPRoutes []*HTTPRouteContext
+
+	for _, h := range httpRoutes {
+		if h == nil {
+			panic("received nil httproute")
+		}
+		httpRoute := &HTTPRouteContext{
+			GatewayControllerName: t.GatewayControllerName,
+			HTTPRoute:             h.DeepCopy(),
+		}
+
+		// Find out if this route attaches to one of our Gateway's listeners,
+		// and if so, get the list of listeners that allow it to attach for each
+		// parentRef.
+		relevantRoute := t.processAllowedListenersForParentRefs(httpRoute, gateways, resources)
+		if !relevantRoute {
+			continue
+		}
+
+		relevantHTTPRoutes = append(relevantHTTPRoutes, httpRoute)
+
+		t.processHTTPRouteParentRefs(httpRoute, resources, xdsIR)
+	}
+
+	return relevantHTTPRoutes
+}
+
+func (t *Translator) ProcessGRPCRoutes(grpcRoutes []*gwapiv1a2.GRPCRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*GRPCRouteContext {
+	var relevantGRPCRoutes []*GRPCRouteContext
+
+	for _, g := range grpcRoutes {
+		if g == nil {
+			panic("received nil grpcroute")
+		}
+		grpcRoute := &GRPCRouteContext{
+			GatewayControllerName: t.GatewayControllerName,
+			GRPCRoute:             g.DeepCopy(),
+		}
+
+		// Find out if this route attaches to one of our Gateway's listeners,
+		// and if so, get the list of listeners that allow it to attach for each
+		// parentRef.
+		relevantRoute := t.processAllowedListenersForParentRefs(grpcRoute, gateways, resources)
+		if !relevantRoute {
+			continue
+		}
+
+		relevantGRPCRoutes = append(relevantGRPCRoutes, grpcRoute)
+
+		t.processGRPCRouteParentRefs(grpcRoute, resources, xdsIR)
+	}
+
+	return relevantGRPCRoutes
+}
+
+func (t *Translator) processHTTPRouteParentRefs(httpRoute *HTTPRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, parentRef := range httpRoute.ParentRefs {
+		// Need to compute Route rules within the parentRef loop because
+		// any conditions that come out of it have to go on each RouteParentStatus,
+		// not on the Route as a whole.
+		routeRoutes, err := t.processHTTPRouteRules(httpRoute, parentRef, resources)
+		if err != nil {
+			parentRef.SetCondition(httpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue, // TODO: better reason
+				status.Error2ConditionMsg(err),
+			)
+			continue
+		}
+
+		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
+		if !parentRef.HasCondition(httpRoute, gwapiv1.RouteConditionResolvedRefs, metav1.ConditionFalse) {
+			parentRef.SetCondition(httpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonResolvedRefs,
+				"Resolved all the Object references for the Route",
+			)
+		}
+
+		// Skip parent refs that did not accept the route
+		if parentRef.HasCondition(httpRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
+			continue
+		}
+		var hasHostnameIntersection = t.processHTTPRouteParentRefListener(httpRoute, routeRoutes, parentRef, xdsIR)
+		if !hasHostnameIntersection {
+			parentRef.SetCondition(httpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonNoMatchingListenerHostname,
+				"There were no hostname intersections between the HTTPRoute and this parent ref's Listener(s).",
+			)
+		}
+
+		// If no negative conditions have been set, the route is considered "Accepted=True".
+		if parentRef.HTTPRoute != nil &&
+			len(parentRef.HTTPRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
+			parentRef.SetCondition(httpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonAccepted,
+				"Route is accepted",
+			)
+		}
+
+	}
+}
+
+func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRef *RouteParentContext, resources *Resources) ([]*ir.HTTPRoute, error) {
+	var routeRoutes []*ir.HTTPRoute
+
+	// compute matches, filters, backends
+	for ruleIdx, rule := range httpRoute.Spec.Rules {
+		httpFiltersContext := t.ProcessHTTPFilters(parentRef, httpRoute, rule.Filters, ruleIdx, resources)
+
+		// A rule is matched if any one of its matches
+		// is satisfied (i.e. a logical "OR"), so generate
+		// a unique Xds IR HTTPRoute per match.
+		ruleRoutes, err := t.processHTTPRouteRule(httpRoute, ruleIdx, httpFiltersContext, rule)
+		if err != nil {
+			return nil, err
+		}
+
+		dstAddrTypeMap := make(map[ir.DestinationAddressType]int)
+
+		for _, backendRef := range rule.BackendRefs {
+			backendRef := backendRef
+			ds, backendWeight := t.processDestination(backendRef, parentRef, httpRoute, resources)
+			if !t.EndpointRoutingDisabled && ds != nil && len(ds.Endpoints) > 0 && ds.AddressType != nil {
+				dstAddrTypeMap[*ds.AddressType]++
+			}
+
+			for _, route := range ruleRoutes {
+				// If the route already has a direct response or redirect configured, then it was from a filter so skip
+				// processing any destinations for this route.
+				if route.DirectResponse == nil && route.Redirect == nil {
+					if ds != nil && len(ds.Endpoints) > 0 {
+						if route.Destination == nil {
+							route.Destination = &ir.RouteDestination{
+								Name: irRouteDestinationName(httpRoute, ruleIdx),
+							}
+						}
+						route.Destination.Settings = append(route.Destination.Settings, ds)
+						route.BackendWeights.Valid += backendWeight
+					} else {
+						route.BackendWeights.Invalid += backendWeight
+					}
+				}
+			}
+		}
+
+		// TODO: support mixed endpointslice address type between backendRefs
+		if !t.EndpointRoutingDisabled && len(dstAddrTypeMap) > 1 {
+			parentRef.SetCondition(httpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1a2.RouteReasonResolvedRefs,
+				"Mixed endpointslice address type between backendRefs is not supported")
+		}
+
+		// If the route has no valid backends then just use a direct response and don't fuss with weighted responses
+		for _, ruleRoute := range ruleRoutes {
+			if ruleRoute.Destination == nil && ruleRoute.Redirect == nil {
+				ruleRoute.DirectResponse = &ir.DirectResponse{
+					StatusCode: 500,
+				}
+			}
+			ruleRoute.IsHTTP2 = false
+		}
+
+		// TODO handle:
+		//	- sum of weights for valid backend refs is 0
+		//	- etc.
+
+		routeRoutes = append(routeRoutes, ruleRoutes...)
+	}
+
+	return routeRoutes, nil
+}
+
+func processTimeout(irRoute *ir.HTTPRoute, rule gwapiv1.HTTPRouteRule) {
+	if rule.Timeouts != nil {
+		var rto *ir.Timeout
+
+		// Timeout is translated from multiple resources and may already be partially set
+		if irRoute.Timeout != nil {
+			rto = irRoute.Timeout.DeepCopy()
+		} else {
+			rto = &ir.Timeout{}
+		}
+
+		if rule.Timeouts.Request != nil {
+			d, err := time.ParseDuration(string(*rule.Timeouts.Request))
+			if err != nil {
+				d, _ = time.ParseDuration(HTTPRequestTimeout)
+			}
+			setRequestTimeout(rto, metav1.Duration{Duration: d})
+		}
+
+		// Also set the IR Route Timeout to the backend request timeout
+		// until we introduce retries, then set it to per try timeout
+		if rule.Timeouts.BackendRequest != nil {
+			d, err := time.ParseDuration(string(*rule.Timeouts.BackendRequest))
+			if err != nil {
+				d, _ = time.ParseDuration(HTTPRequestTimeout)
+			}
+			setRequestTimeout(rto, metav1.Duration{Duration: d})
+		}
+
+		irRoute.Timeout = rto
+	}
+}
+
+func setRequestTimeout(irTimeout *ir.Timeout, d metav1.Duration) {
+	switch {
+	case irTimeout == nil:
+		irTimeout = &ir.Timeout{
+			HTTP: &ir.HTTPTimeout{
+				RequestTimeout: ptr.To(d),
+			},
+		}
+	case irTimeout.HTTP == nil:
+		irTimeout.HTTP = &ir.HTTPTimeout{
+			RequestTimeout: ptr.To(d),
+		}
+	default:
+		irTimeout.HTTP.RequestTimeout = ptr.To(d)
+	}
+}
+
+func (t *Translator) processHTTPRouteRule(httpRoute *HTTPRouteContext, ruleIdx int, httpFiltersContext *HTTPFiltersContext, rule gwapiv1.HTTPRouteRule) ([]*ir.HTTPRoute, error) {
+	var ruleRoutes []*ir.HTTPRoute
+
+	// If no matches are specified, the implementation MUST match every HTTP request.
+	if len(rule.Matches) == 0 {
+		irRoute := &ir.HTTPRoute{
+			Name: irRouteName(httpRoute, ruleIdx, -1),
+		}
+		processTimeout(irRoute, rule)
+		applyHTTPFiltersContextToIRRoute(httpFiltersContext, irRoute)
+		ruleRoutes = append(ruleRoutes, irRoute)
+	}
+
+	// A rule is matched if any one of its matches
+	// is satisfied (i.e. a logical "OR"), so generate
+	// a unique Xds IR HTTPRoute per match.
+	for matchIdx, match := range rule.Matches {
+		irRoute := &ir.HTTPRoute{
+			Name: irRouteName(httpRoute, ruleIdx, matchIdx),
+		}
+		processTimeout(irRoute, rule)
+
+		if match.Path != nil {
+			switch PathMatchTypeDerefOr(match.Path.Type, gwapiv1.PathMatchPathPrefix) {
+			case gwapiv1.PathMatchPathPrefix:
+				irRoute.PathMatch = &ir.StringMatch{
+					Prefix: match.Path.Value,
+				}
+			case gwapiv1.PathMatchExact:
+				irRoute.PathMatch = &ir.StringMatch{
+					Exact: match.Path.Value,
+				}
+			case gwapiv1.PathMatchRegularExpression:
+				if err := regex.Validate(*match.Path.Value); err != nil {
+					return nil, err
+				}
+				irRoute.PathMatch = &ir.StringMatch{
+					SafeRegex: match.Path.Value,
+				}
+			}
+		}
+		for _, headerMatch := range match.Headers {
+			switch HeaderMatchTypeDerefOr(headerMatch.Type, gwapiv1.HeaderMatchExact) {
+			case gwapiv1.HeaderMatchExact:
+				irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+					Name:  string(headerMatch.Name),
+					Exact: ptr.To(headerMatch.Value),
+				})
+			case gwapiv1.HeaderMatchRegularExpression:
+				if err := regex.Validate(headerMatch.Value); err != nil {
+					return nil, err
+				}
+				irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+					Name:      string(headerMatch.Name),
+					SafeRegex: ptr.To(headerMatch.Value),
+				})
+			}
+		}
+		for _, queryParamMatch := range match.QueryParams {
+			switch QueryParamMatchTypeDerefOr(queryParamMatch.Type, gwapiv1.QueryParamMatchExact) {
+			case gwapiv1.QueryParamMatchExact:
+				irRoute.QueryParamMatches = append(irRoute.QueryParamMatches, &ir.StringMatch{
+					Name:  string(queryParamMatch.Name),
+					Exact: ptr.To(queryParamMatch.Value),
+				})
+			case gwapiv1.QueryParamMatchRegularExpression:
+				if err := regex.Validate(queryParamMatch.Value); err != nil {
+					return nil, err
+				}
+				irRoute.QueryParamMatches = append(irRoute.QueryParamMatches, &ir.StringMatch{
+					Name:      string(queryParamMatch.Name),
+					SafeRegex: ptr.To(queryParamMatch.Value),
+				})
+			}
+		}
+
+		if match.Method != nil {
+			irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+				Name:  ":method",
+				Exact: ptr.To(string(*match.Method)),
+			})
+		}
+		applyHTTPFiltersContextToIRRoute(httpFiltersContext, irRoute)
+		ruleRoutes = append(ruleRoutes, irRoute)
+	}
+
+	return ruleRoutes, nil
+}
+
+func applyHTTPFiltersContextToIRRoute(httpFiltersContext *HTTPFiltersContext, irRoute *ir.HTTPRoute) {
+	// Add the redirect filter or direct response that were created earlier to all the irRoutes
+	if httpFiltersContext.RedirectResponse != nil {
+		irRoute.Redirect = httpFiltersContext.RedirectResponse
+	}
+	if httpFiltersContext.DirectResponse != nil {
+		irRoute.DirectResponse = httpFiltersContext.DirectResponse
+	}
+	if httpFiltersContext.URLRewrite != nil {
+		irRoute.URLRewrite = httpFiltersContext.URLRewrite
+	}
+	if len(httpFiltersContext.AddRequestHeaders) > 0 {
+		irRoute.AddRequestHeaders = httpFiltersContext.AddRequestHeaders
+	}
+	if len(httpFiltersContext.RemoveRequestHeaders) > 0 {
+		irRoute.RemoveRequestHeaders = httpFiltersContext.RemoveRequestHeaders
+	}
+	if len(httpFiltersContext.AddResponseHeaders) > 0 {
+		irRoute.AddResponseHeaders = httpFiltersContext.AddResponseHeaders
+	}
+	if len(httpFiltersContext.RemoveResponseHeaders) > 0 {
+		irRoute.RemoveResponseHeaders = httpFiltersContext.RemoveResponseHeaders
+	}
+	if httpFiltersContext.Mirrors != nil {
+		irRoute.Mirrors = httpFiltersContext.Mirrors
+	}
+
+	if len(httpFiltersContext.ExtensionRefs) > 0 {
+		irRoute.ExtensionRefs = httpFiltersContext.ExtensionRefs
+	}
+
+}
+
+func (t *Translator) processGRPCRouteParentRefs(grpcRoute *GRPCRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, parentRef := range grpcRoute.ParentRefs {
+
+		// Need to compute Route rules within the parentRef loop because
+		// any conditions that come out of it have to go on each RouteParentStatus,
+		// not on the Route as a whole.
+		routeRoutes, err := t.processGRPCRouteRules(grpcRoute, parentRef, resources)
+		if err != nil {
+			parentRef.SetCondition(grpcRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue, // TODO: better reason
+				status.Error2ConditionMsg(err),
+			)
+			continue
+		}
+
+		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
+		if !parentRef.HasCondition(grpcRoute, gwapiv1.RouteConditionResolvedRefs, metav1.ConditionFalse) {
+			parentRef.SetCondition(grpcRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonResolvedRefs,
+				"Resolved all the Object references for the Route",
+			)
+		}
+
+		if parentRef.HasCondition(grpcRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
+			continue
+		}
+		var hasHostnameIntersection = t.processHTTPRouteParentRefListener(grpcRoute, routeRoutes, parentRef, xdsIR)
+		if !hasHostnameIntersection {
+			parentRef.SetCondition(grpcRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonNoMatchingListenerHostname,
+				"There were no hostname intersections between the GRPCRoute and this parent ref's Listener(s).",
+			)
+		}
+
+		// If no negative conditions have been set, the route is considered "Accepted=True".
+		if parentRef.GRPCRoute != nil &&
+			len(parentRef.GRPCRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
+			parentRef.SetCondition(grpcRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonAccepted,
+				"Route is accepted",
+			)
+		}
+
+	}
+}
+
+func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRef *RouteParentContext, resources *Resources) ([]*ir.HTTPRoute, error) {
+	var routeRoutes []*ir.HTTPRoute
+
+	// compute matches, filters, backends
+	for ruleIdx, rule := range grpcRoute.Spec.Rules {
+		httpFiltersContext := t.ProcessGRPCFilters(parentRef, grpcRoute, rule.Filters, resources)
+
+		// A rule is matched if any one of its matches
+		// is satisfied (i.e. a logical "OR"), so generate
+		// a unique Xds IR HTTPRoute per match.
+		ruleRoutes, err := t.processGRPCRouteRule(grpcRoute, ruleIdx, httpFiltersContext, rule)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, backendRef := range rule.BackendRefs {
+			backendRef := backendRef
+			ds, backendWeight := t.processDestination(backendRef, parentRef, grpcRoute, resources)
+			for _, route := range ruleRoutes {
+				// If the route already has a direct response or redirect configured, then it was from a filter so skip
+				// processing any destinations for this route.
+				if route.DirectResponse == nil && route.Redirect == nil {
+					if ds != nil && len(ds.Endpoints) > 0 {
+						if route.Destination == nil {
+							route.Destination = &ir.RouteDestination{
+								Name: irRouteDestinationName(grpcRoute, ruleIdx),
+							}
+						}
+						route.Destination.Settings = append(route.Destination.Settings, ds)
+						route.BackendWeights.Valid += backendWeight
+
+					} else {
+						route.BackendWeights.Invalid += backendWeight
+					}
+				}
+			}
+		}
+
+		// If the route has no valid backends then just use a direct response and don't fuss with weighted responses
+		for _, ruleRoute := range ruleRoutes {
+			if ruleRoute.Destination == nil && ruleRoute.Redirect == nil {
+				ruleRoute.DirectResponse = &ir.DirectResponse{
+					StatusCode: 500,
+				}
+			}
+			ruleRoute.IsHTTP2 = true
+		}
+
+		// TODO handle:
+		//	- sum of weights for valid backend refs is 0
+		//	- etc.
+
+		routeRoutes = append(routeRoutes, ruleRoutes...)
+	}
+
+	return routeRoutes, nil
+}
+
+func (t *Translator) processGRPCRouteRule(grpcRoute *GRPCRouteContext, ruleIdx int, httpFiltersContext *HTTPFiltersContext, rule gwapiv1a2.GRPCRouteRule) ([]*ir.HTTPRoute, error) {
+	var ruleRoutes []*ir.HTTPRoute
+
+	// If no matches are specified, the implementation MUST match every gRPC request.
+	if len(rule.Matches) == 0 {
+		irRoute := &ir.HTTPRoute{
+			Name: irRouteName(grpcRoute, ruleIdx, -1),
+		}
+		applyHTTPFiltersContextToIRRoute(httpFiltersContext, irRoute)
+		ruleRoutes = append(ruleRoutes, irRoute)
+	}
+
+	// A rule is matched if any one of its matches
+	// is satisfied (i.e. a logical "OR"), so generate
+	// a unique Xds IR HTTPRoute per match.
+	for matchIdx, match := range rule.Matches {
+		irRoute := &ir.HTTPRoute{
+			Name: irRouteName(grpcRoute, ruleIdx, matchIdx),
+		}
+
+		for _, headerMatch := range match.Headers {
+			switch HeaderMatchTypeDerefOr(headerMatch.Type, gwapiv1.HeaderMatchExact) {
+			case gwapiv1.HeaderMatchExact:
+				irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+					Name:  string(headerMatch.Name),
+					Exact: ptr.To(headerMatch.Value),
+				})
+			case gwapiv1.HeaderMatchRegularExpression:
+				if err := regex.Validate(headerMatch.Value); err != nil {
+					return nil, err
+				}
+				irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+					Name:      string(headerMatch.Name),
+					SafeRegex: ptr.To(headerMatch.Value),
+				})
+			}
+		}
+
+		if match.Method != nil {
+			// GRPC's path is in the form of "/<service>/<method>"
+			switch GRPCMethodMatchTypeDerefOr(match.Method.Type, gwapiv1a2.GRPCMethodMatchExact) {
+			case gwapiv1a2.GRPCMethodMatchExact:
+				t.processGRPCRouteMethodExact(match.Method, irRoute)
+			case gwapiv1a2.GRPCMethodMatchRegularExpression:
+				if match.Method.Service != nil {
+					if err := regex.Validate(*match.Method.Service); err != nil {
+						return nil, err
+					}
+				}
+				if match.Method.Method != nil {
+					if err := regex.Validate(*match.Method.Method); err != nil {
+						return nil, err
+					}
+				}
+				t.processGRPCRouteMethodRegularExpression(match.Method, irRoute)
+			}
+		}
+
+		ruleRoutes = append(ruleRoutes, irRoute)
+		applyHTTPFiltersContextToIRRoute(httpFiltersContext, irRoute)
+	}
+	return ruleRoutes, nil
+}
+
+func (t *Translator) processGRPCRouteMethodExact(method *gwapiv1a2.GRPCMethodMatch, irRoute *ir.HTTPRoute) {
+	switch {
+	case method.Service != nil && method.Method != nil:
+		irRoute.PathMatch = &ir.StringMatch{
+			Exact: ptr.To(fmt.Sprintf("/%s/%s", *method.Service, *method.Method)),
+		}
+	case method.Method != nil:
+		// Use a header match since the PathMatch doesn't support Suffix matching
+		irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+			Name:   ":path",
+			Suffix: ptr.To(fmt.Sprintf("/%s", *method.Method)),
+		})
+	case method.Service != nil:
+		irRoute.PathMatch = &ir.StringMatch{
+			Prefix: ptr.To(fmt.Sprintf("/%s", *method.Service)),
+		}
+	}
+}
+
+func (t *Translator) processGRPCRouteMethodRegularExpression(method *gwapiv1a2.GRPCMethodMatch, irRoute *ir.HTTPRoute) {
+	switch {
+	case method.Service != nil && method.Method != nil:
+		irRoute.PathMatch = &ir.StringMatch{
+			SafeRegex: ptr.To(fmt.Sprintf("/%s/%s", *method.Service, *method.Method)),
+		}
+	case method.Method != nil:
+		irRoute.PathMatch = &ir.StringMatch{
+			SafeRegex: ptr.To(fmt.Sprintf("/%s/%s", validServiceName, *method.Method)),
+		}
+	case method.Service != nil:
+		irRoute.PathMatch = &ir.StringMatch{
+			SafeRegex: ptr.To(fmt.Sprintf("/%s/%s", *method.Service, validMethodName)),
+		}
+	}
+}
+
+func (t *Translator) processHTTPRouteParentRefListener(route RouteContext, routeRoutes []*ir.HTTPRoute, parentRef *RouteParentContext, xdsIR XdsIRMap) bool {
+	var hasHostnameIntersection bool
+
+	for _, listener := range parentRef.listeners {
+		hosts := computeHosts(GetHostnames(route), listener.Hostname)
+		if len(hosts) == 0 {
+			continue
+		}
+		hasHostnameIntersection = true
+
+		var perHostRoutes []*ir.HTTPRoute
+		for _, host := range hosts {
+			for _, routeRoute := range routeRoutes {
+				// If the redirect port is not set, the final redirect port must be derived.
+				if routeRoute.Redirect != nil && routeRoute.Redirect.Port == nil {
+					redirectPort := uint32(listener.Port)
+					// If redirect scheme is not-empty, the redirect post must be the
+					// well-known port associated with the redirect scheme.
+					if scheme := routeRoute.Redirect.Scheme; scheme != nil {
+						switch strings.ToLower(*scheme) {
+						case "http":
+							redirectPort = 80
+						case "https":
+							redirectPort = 443
+						}
+					}
+					// If the redirect scheme does not have a well-known port, or
+					// if the redirect scheme is empty, the redirect port must be the Gateway Listener port.
+					routeRoute.Redirect.Port = &redirectPort
+				}
+				// Remove dots from the hostname before appending it to the IR Route name
+				// since dots are special chars used in stats tag extraction in Envoy
+				underscoredHost := strings.ReplaceAll(host, ".", "_")
+				hostRoute := &ir.HTTPRoute{
+					Name:                  fmt.Sprintf("%s/%s", routeRoute.Name, underscoredHost),
+					Hostname:              host,
+					PathMatch:             routeRoute.PathMatch,
+					HeaderMatches:         routeRoute.HeaderMatches,
+					QueryParamMatches:     routeRoute.QueryParamMatches,
+					AddRequestHeaders:     routeRoute.AddRequestHeaders,
+					RemoveRequestHeaders:  routeRoute.RemoveRequestHeaders,
+					AddResponseHeaders:    routeRoute.AddResponseHeaders,
+					RemoveResponseHeaders: routeRoute.RemoveResponseHeaders,
+					Destination:           routeRoute.Destination,
+					Redirect:              routeRoute.Redirect,
+					DirectResponse:        routeRoute.DirectResponse,
+					URLRewrite:            routeRoute.URLRewrite,
+					Mirrors:               routeRoute.Mirrors,
+					ExtensionRefs:         routeRoute.ExtensionRefs,
+					Timeout:               routeRoute.Timeout,
+					Retry:                 routeRoute.Retry,
+					IsHTTP2:               routeRoute.IsHTTP2,
+				}
+				// Don't bother copying over the weights unless the route has invalid backends.
+				if routeRoute.BackendWeights.Invalid > 0 {
+					hostRoute.BackendWeights = routeRoute.BackendWeights
+				}
+				perHostRoutes = append(perHostRoutes, hostRoute)
+			}
+		}
+		irKey := t.getIRKey(listener.gateway)
+		irListener := xdsIR[irKey].GetHTTPListener(irHTTPListenerName(listener))
+		if irListener != nil {
+			if GetRouteType(route) == KindGRPCRoute {
+				irListener.IsHTTP2 = true
+			}
+			irListener.Routes = append(irListener.Routes, perHostRoutes...)
+		}
+	}
+
+	return hasHostnameIntersection
+}
+
+func (t *Translator) ProcessTLSRoutes(tlsRoutes []*gwapiv1a2.TLSRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*TLSRouteContext {
+	var relevantTLSRoutes []*TLSRouteContext
+
+	for _, tls := range tlsRoutes {
+		if tls == nil {
+			panic("received nil tlsroute")
+		}
+		tlsRoute := &TLSRouteContext{
+			GatewayControllerName: t.GatewayControllerName,
+			TLSRoute:              tls.DeepCopy(),
+		}
+
+		// Find out if this route attaches to one of our Gateway's listeners,
+		// and if so, get the list of listeners that allow it to attach for each
+		// parentRef.
+		relevantRoute := t.processAllowedListenersForParentRefs(tlsRoute, gateways, resources)
+		if !relevantRoute {
+			continue
+		}
+
+		relevantTLSRoutes = append(relevantTLSRoutes, tlsRoute)
+
+		t.processTLSRouteParentRefs(tlsRoute, resources, xdsIR)
+	}
+
+	return relevantTLSRoutes
+}
+
+func (t *Translator) processTLSRouteParentRefs(tlsRoute *TLSRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, parentRef := range tlsRoute.ParentRefs {
+
+		// Need to compute Route rules within the parentRef loop because
+		// any conditions that come out of it have to go on each RouteParentStatus,
+		// not on the Route as a whole.
+		var destSettings []*ir.DestinationSetting
+
+		// compute backends
+		for _, rule := range tlsRoute.Spec.Rules {
+			for _, backendRef := range rule.BackendRefs {
+				backendRef := backendRef
+				ds, _ := t.processDestination(backendRef, parentRef, tlsRoute, resources)
+				if ds != nil {
+					destSettings = append(destSettings, ds)
+				}
+			}
+
+			// TODO handle:
+			//	- no valid backend refs
+			//	- sum of weights for valid backend refs is 0
+			//	- returning 500's for invalid backend refs
+			//	- etc.
+		}
+
+		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
+		if !parentRef.HasCondition(tlsRoute, gwapiv1.RouteConditionResolvedRefs, metav1.ConditionFalse) {
+			parentRef.SetCondition(tlsRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonResolvedRefs,
+				"Resolved all the Object references for the Route",
+			)
+		}
+
+		// Skip parent refs that did not accept the route
+		if parentRef.HasCondition(tlsRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
+			continue
+		}
+
+		var hasHostnameIntersection bool
+		for _, listener := range parentRef.listeners {
+			hosts := computeHosts(GetHostnames(tlsRoute), listener.Hostname)
+			if len(hosts) == 0 {
+				continue
+			}
+
+			hasHostnameIntersection = true
+
+			irKey := t.getIRKey(listener.gateway)
+
+			containerPort := servicePortToContainerPort(int32(listener.Port))
+			// Create the TCP Listener while parsing the TLSRoute since
+			// the listener directly links to a routeDestination.
+			irListener := &ir.TCPListener{
+				Name:    irTLSListenerName(listener, tlsRoute),
+				Address: "0.0.0.0",
+				Port:    uint32(containerPort),
+				TLS: &ir.TLS{Passthrough: &ir.TLSInspectorConfig{
+					SNIs: hosts,
+				}},
+				Destination: &ir.RouteDestination{
+					Name:     irRouteDestinationName(tlsRoute, -1 /*rule index*/),
+					Settings: destSettings,
+				},
+			}
+			gwXdsIR := xdsIR[irKey]
+			gwXdsIR.TCP = append(gwXdsIR.TCP, irListener)
+
+		}
+
+		if !hasHostnameIntersection {
+			parentRef.SetCondition(tlsRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonNoMatchingListenerHostname,
+				"There were no hostname intersections between the HTTPRoute and this parent ref's Listener(s).",
+			)
+		}
+
+		// If no negative conditions have been set, the route is considered "Accepted=True".
+		if parentRef.TLSRoute != nil &&
+			len(parentRef.TLSRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
+			parentRef.SetCondition(tlsRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonAccepted,
+				"Route is accepted",
+			)
+		}
+	}
+}
+
+func (t *Translator) ProcessUDPRoutes(udpRoutes []*gwapiv1a2.UDPRoute, gateways []*GatewayContext, resources *Resources,
+	xdsIR XdsIRMap) []*UDPRouteContext {
+	var relevantUDPRoutes []*UDPRouteContext
+
+	for _, u := range udpRoutes {
+		if u == nil {
+			panic("received nil udproute")
+		}
+		udpRoute := &UDPRouteContext{
+			GatewayControllerName: t.GatewayControllerName,
+			UDPRoute:              u.DeepCopy(),
+		}
+
+		// Find out if this route attaches to one of our Gateway's listeners,
+		// and if so, get the list of listeners that allow it to attach for each
+		// parentRef.
+		relevantRoute := t.processAllowedListenersForParentRefs(udpRoute, gateways, resources)
+		if !relevantRoute {
+			continue
+		}
+
+		relevantUDPRoutes = append(relevantUDPRoutes, udpRoute)
+
+		t.processUDPRouteParentRefs(udpRoute, resources, xdsIR)
+	}
+
+	return relevantUDPRoutes
+}
+
+func (t *Translator) processUDPRouteParentRefs(udpRoute *UDPRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, parentRef := range udpRoute.ParentRefs {
+		// Need to compute Route rules within the parentRef loop because
+		// any conditions that come out of it have to go on each RouteParentStatus,
+		// not on the Route as a whole.
+		var destSettings []*ir.DestinationSetting
+
+		// compute backends
+		if len(udpRoute.Spec.Rules) != 1 {
+			parentRef.SetCondition(udpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				"InvalidRule",
+				"One and only one rule is supported",
+			)
+			continue
+		}
+		if len(udpRoute.Spec.Rules[0].BackendRefs) != 1 {
+			parentRef.SetCondition(udpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				"InvalidBackend",
+				"One and only one backend is supported",
+			)
+			continue
+		}
+
+		backendRef := udpRoute.Spec.Rules[0].BackendRefs[0]
+		ds, _ := t.processDestination(backendRef, parentRef, udpRoute, resources)
+		// Skip further processing if route destination is not valid
+		if ds == nil || len(ds.Endpoints) == 0 {
+			continue
+		}
+
+		destSettings = append(destSettings, ds)
+		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
+		if !parentRef.HasCondition(udpRoute, gwapiv1.RouteConditionResolvedRefs, metav1.ConditionFalse) {
+			parentRef.SetCondition(udpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonResolvedRefs,
+				"Resolved all the Object references for the Route",
+			)
+		}
+
+		// Skip parent refs that did not accept the route
+		if parentRef.HasCondition(udpRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
+			continue
+		}
+
+		accepted := false
+		for _, listener := range parentRef.listeners {
+			// only one route is allowed for a UDP listener
+			if listener.AttachedRoutes() > 1 {
+				continue
+			}
+			if !listener.IsReady() {
+				continue
+			}
+			accepted = true
+
+			irKey := t.getIRKey(listener.gateway)
+
+			containerPort := servicePortToContainerPort(int32(listener.Port))
+			// Create the UDP Listener while parsing the UDPRoute since
+			// the listener directly links to a routeDestination.
+			irListener := &ir.UDPListener{
+				Name:    irUDPListenerName(listener, udpRoute),
+				Address: "0.0.0.0",
+				Port:    uint32(containerPort),
+				Destination: &ir.RouteDestination{
+					Name:     irRouteDestinationName(udpRoute, -1 /*rule index*/),
+					Settings: destSettings,
+				},
+			}
+			gwXdsIR := xdsIR[irKey]
+			gwXdsIR.UDP = append(gwXdsIR.UDP, irListener)
+
+		}
+
+		// If no negative conditions have been set, the route is considered "Accepted=True".
+		if accepted && parentRef.UDPRoute != nil &&
+			len(parentRef.UDPRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
+			parentRef.SetCondition(udpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonAccepted,
+				"Route is accepted",
+			)
+		}
+
+		if !accepted {
+			parentRef.SetCondition(udpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				"Multiple routes on the same UDP listener",
+			)
+		}
+	}
+}
+
+func (t *Translator) ProcessTCPRoutes(tcpRoutes []*gwapiv1a2.TCPRoute, gateways []*GatewayContext, resources *Resources,
+	xdsIR XdsIRMap) []*TCPRouteContext {
+	var relevantTCPRoutes []*TCPRouteContext
+
+	for _, tcp := range tcpRoutes {
+		if tcp == nil {
+			panic("received nil tcproute")
+		}
+		tcpRoute := &TCPRouteContext{
+			GatewayControllerName: t.GatewayControllerName,
+			TCPRoute:              tcp.DeepCopy(),
+		}
+
+		// Find out if this route attaches to one of our Gateway's listeners,
+		// and if so, get the list of listeners that allow it to attach for each
+		// parentRef.
+		relevantRoute := t.processAllowedListenersForParentRefs(tcpRoute, gateways, resources)
+		if !relevantRoute {
+			continue
+		}
+
+		relevantTCPRoutes = append(relevantTCPRoutes, tcpRoute)
+
+		t.processTCPRouteParentRefs(tcpRoute, resources, xdsIR)
+	}
+
+	return relevantTCPRoutes
+}
+
+func (t *Translator) processTCPRouteParentRefs(tcpRoute *TCPRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, parentRef := range tcpRoute.ParentRefs {
+
+		// Need to compute Route rules within the parentRef loop because
+		// any conditions that come out of it have to go on each RouteParentStatus,
+		// not on the Route as a whole.
+		var destSettings []*ir.DestinationSetting
+
+		// compute backends
+		if len(tcpRoute.Spec.Rules) != 1 {
+			parentRef.SetCondition(tcpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				"InvalidRule",
+				"One and only one rule is supported",
+			)
+			continue
+		}
+		if len(tcpRoute.Spec.Rules[0].BackendRefs) != 1 {
+			parentRef.SetCondition(tcpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				"InvalidBackend",
+				"One and only one backend is supported",
+			)
+			continue
+		}
+
+		backendRef := tcpRoute.Spec.Rules[0].BackendRefs[0]
+		ds, _ := t.processDestination(backendRef, parentRef, tcpRoute, resources)
+		// Skip further processing if route destination is not valid
+		if ds == nil || len(ds.Endpoints) == 0 {
+			continue
+		}
+		destSettings = append(destSettings, ds)
+		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
+		if !parentRef.HasCondition(tcpRoute, gwapiv1.RouteConditionResolvedRefs, metav1.ConditionFalse) {
+			parentRef.SetCondition(tcpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonResolvedRefs,
+				"Resolved all the Object references for the Route",
+			)
+		}
+
+		// Skip parent refs that did not accept the route
+		if parentRef.HasCondition(tcpRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
+			continue
+		}
+
+		accepted := false
+		for _, listener := range parentRef.listeners {
+			// only one route is allowed for a TCP listener
+			if listener.AttachedRoutes() > 1 {
+				continue
+			}
+			if !listener.IsReady() {
+				continue
+			}
+			accepted = true
+			irKey := t.getIRKey(listener.gateway)
+
+			containerPort := servicePortToContainerPort(int32(listener.Port))
+			// Create the TCP Listener while parsing the TCPRoute since
+			// the listener directly links to a routeDestination.
+			irListener := &ir.TCPListener{
+				Name:    irTCPListenerName(listener, tcpRoute),
+				Address: "0.0.0.0",
+				Port:    uint32(containerPort),
+				Destination: &ir.RouteDestination{
+					Name:     irRouteDestinationName(tcpRoute, -1 /*rule index*/),
+					Settings: destSettings,
+				},
+				TLS: &ir.TLS{Terminate: irTLSConfigs(listener.tlsSecrets)},
+			}
+			gwXdsIR := xdsIR[irKey]
+			gwXdsIR.TCP = append(gwXdsIR.TCP, irListener)
+
+		}
+
+		// If no negative conditions have been set, the route is considered "Accepted=True".
+		if accepted && parentRef.TCPRoute != nil &&
+			len(parentRef.TCPRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
+			parentRef.SetCondition(tcpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonAccepted,
+				"Route is accepted",
+			)
+		}
+		if !accepted {
+			parentRef.SetCondition(tcpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				"Multiple routes on the same TCP listener",
+			)
+		}
+
+	}
+}
+
+// processDestination takes a backendRef and translates it into destination setting or sets error statuses and
+// returns the weight for the backend so that 500 error responses can be returned for invalid backends in
+// the same proportion as the backend would have otherwise received
+func (t *Translator) processDestination(backendRefContext BackendRefContext,
+	parentRef *RouteParentContext,
+	route RouteContext,
+	resources *Resources) (ds *ir.DestinationSetting, backendWeight uint32) {
+	routeType := GetRouteType(route)
+	weight := uint32(1)
+	backendRef := GetBackendRef(backendRefContext)
+	if backendRef.Weight != nil {
+		weight = uint32(*backendRef.Weight)
+	}
+
+	backendNamespace := NamespaceDerefOr(backendRef.Namespace, route.GetNamespace())
+	if !t.validateBackendRef(backendRefContext, parentRef, route, resources, backendNamespace, routeType) {
+		return nil, weight
+	}
+
+	// Skip processing backends with 0 weight
+	if weight == 0 {
+		return nil, weight
+	}
+
+	var (
+		endpoints []*ir.DestinationEndpoint
+		addrType  *ir.DestinationAddressType
+	)
+	protocol := inspectAppProtocolByRouteKind(routeType)
+	var backendTLS *ir.TLSUpstreamConfig
+	switch KindDerefOr(backendRef.Kind, KindService) {
+	case KindService:
+		service := resources.GetService(backendNamespace, string(backendRef.Name))
+		var servicePort corev1.ServicePort
+		for _, port := range service.Spec.Ports {
+			if port.Port == int32(*backendRef.Port) {
+				servicePort = port
+				break
+			}
+		}
+
+		// support HTTPRouteBackendProtocolH2C
+		if servicePort.AppProtocol != nil &&
+			*servicePort.AppProtocol == "kubernetes.io/h2c" {
+			protocol = ir.HTTP2
+		}
+
+		// Route to endpoints by default
+		if !t.EndpointRoutingDisabled {
+			endpointSlices := resources.GetEndpointSlicesForBackend(backendNamespace, string(backendRef.Name), KindDerefOr(backendRef.Kind, KindService))
+			endpoints, addrType = getIREndpointsFromEndpointSlices(endpointSlices, servicePort.Name, servicePort.Protocol)
+		} else {
+			// Fall back to Service ClusterIP routing
+			ep := ir.NewDestEndpoint(
+				service.Spec.ClusterIP,
+				uint32(*backendRef.Port))
+			endpoints = append(endpoints, ep)
+		}
+	}
+
+	// TODO: support mixed endpointslice address type for the same backendRef
+	if !t.EndpointRoutingDisabled && addrType != nil && *addrType == ir.MIXED {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1a2.RouteReasonResolvedRefs,
+			"Mixed endpointslice address type for the same backendRef is not supported")
+	}
+
+	ds = &ir.DestinationSetting{
+		Weight:      &weight,
+		Protocol:    protocol,
+		Endpoints:   endpoints,
+		AddressType: addrType,
+		TLS:         backendTLS,
+	}
+	return ds, weight
+}
+
+func inspectAppProtocolByRouteKind(kind gwapiv1.Kind) ir.AppProtocol {
+	switch kind {
+	case KindUDPRoute:
+		return ir.UDP
+	case KindHTTPRoute:
+		return ir.HTTP
+	case KindTCPRoute:
+		return ir.TCP
+	case KindGRPCRoute:
+		return ir.GRPC
+	case KindTLSRoute:
+		return ir.HTTPS
+	}
+	return ir.TCP
+}
+
+// processAllowedListenersForParentRefs finds out if the route attaches to one of our
+// Gateways' listeners, and if so, gets the list of listeners that allow it to
+// attach for each parentRef.
+func (t *Translator) processAllowedListenersForParentRefs(routeContext RouteContext, gateways []*GatewayContext, resources *Resources) bool {
+	var relevantRoute bool
+
+	for _, parentRef := range GetParentReferences(routeContext) {
+		isRelevantParentRef, selectedListeners := GetReferencedListeners(parentRef, gateways)
+
+		// Parent ref is not to a Gateway that we control: skip it
+		if !isRelevantParentRef {
+			continue
+		}
+		relevantRoute = true
+
+		parentRefCtx := GetRouteParentContext(routeContext, parentRef)
+		// Reset conditions since they will be recomputed during translation
+		parentRefCtx.ResetConditions(routeContext)
+
+		if len(selectedListeners) == 0 {
+			parentRefCtx.SetCondition(routeContext,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonNoMatchingParent,
+				"No listeners match this parent ref",
+			)
+			continue
+		}
+
+		var allowedListeners []*ListenerContext
+		for _, listener := range selectedListeners {
+			acceptedKind := GetRouteType(routeContext)
+			if listener.AllowsKind(gwapiv1.RouteGroupKind{Group: GroupPtr(gwapiv1.GroupName), Kind: acceptedKind}) &&
+				listener.AllowsNamespace(resources.GetNamespace(routeContext.GetNamespace())) {
+				allowedListeners = append(allowedListeners, listener)
+			}
+		}
+
+		if len(allowedListeners) == 0 {
+			parentRefCtx.SetCondition(routeContext,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonNotAllowedByListeners,
+				"No listeners included by this parent ref allowed this attachment.",
+			)
+			continue
+		}
+
+		// Its safe to increment AttachedRoutes since we've found a valid parentRef
+		// and the listener allows this Route kind
+
+		// Theoretically there should only be one parent ref per
+		// Route that attaches to a given Listener, so fine to just increment here, but we
+		// might want to check to ensure we're not double-counting.
+		for _, listener := range allowedListeners {
+			listener.IncrementAttachedRoutes()
+		}
+
+		if !HasReadyListener(selectedListeners) {
+			parentRefCtx.SetCondition(routeContext,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				"NoReadyListeners",
+				"There are no ready listeners for this parent ref",
+			)
+			continue
+		}
+
+		parentRefCtx.SetListeners(allowedListeners...)
+
+		parentRefCtx.SetCondition(routeContext,
+			gwapiv1.RouteConditionAccepted,
+			metav1.ConditionTrue,
+			gwapiv1.RouteReasonAccepted,
+			"Route is accepted",
+		)
+	}
+	return relevantRoute
+}
+
+func getIREndpointsFromEndpointSlices(endpointSlices []*discoveryv1.EndpointSlice, portName string, portProtocol corev1.Protocol) ([]*ir.DestinationEndpoint, *ir.DestinationAddressType) {
+	var (
+		dstEndpoints []*ir.DestinationEndpoint
+		dstAddrType  *ir.DestinationAddressType
+	)
+
+	addrTypeMap := make(map[ir.DestinationAddressType]int)
+	for _, endpointSlice := range endpointSlices {
+		if endpointSlice.AddressType == discoveryv1.AddressTypeFQDN {
+			addrTypeMap[ir.FQDN]++
+		} else {
+			addrTypeMap[ir.IP]++
+		}
+		endpoints := getIREndpointsFromEndpointSlice(endpointSlice, portName, portProtocol)
+		dstEndpoints = append(dstEndpoints, endpoints...)
+	}
+
+	for addrTypeState, addrTypeCounts := range addrTypeMap {
+		if addrTypeCounts == len(endpointSlices) {
+			dstAddrType = ptr.To(addrTypeState)
+			break
+		}
+	}
+
+	if len(addrTypeMap) > 0 && dstAddrType == nil {
+		dstAddrType = ptr.To(ir.MIXED)
+	}
+
+	return dstEndpoints, dstAddrType
+}
+
+func getIREndpointsFromEndpointSlice(endpointSlice *discoveryv1.EndpointSlice, portName string, portProtocol corev1.Protocol) []*ir.DestinationEndpoint {
+	var endpoints []*ir.DestinationEndpoint
+	for _, endpoint := range endpointSlice.Endpoints {
+		for _, endpointPort := range endpointSlice.Ports {
+			// Check if the endpoint port matches the service port
+			// and if endpoint is Ready
+			if *endpointPort.Name == portName &&
+				*endpointPort.Protocol == portProtocol &&
+				// Unknown state (nil) should be interpreted as Ready, see https://pkg.go.dev/k8s.io/api/discovery/v1#EndpointConditions
+				(endpoint.Conditions.Ready == nil || *endpoint.Conditions.Ready) {
+				for _, address := range endpoint.Addresses {
+					ep := ir.NewDestEndpoint(
+						address,
+						uint32(*endpointPort.Port))
+					endpoints = append(endpoints, ep)
+				}
+			}
+		}
+	}
+
+	return endpoints
+}
+
+func GetTargetBackendReference(backendRef gwapiv1a2.BackendObjectReference, namespace string) gwapiv1a2.PolicyTargetReferenceWithSectionName {
+	ref := gwapiv1a2.PolicyTargetReferenceWithSectionName{
+		PolicyTargetReference: gwapiv1a2.PolicyTargetReference{
+			Group: func() gwapiv1a2.Group {
+				if backendRef.Group == nil {
+					return ""
+				}
+				return *backendRef.Group
+			}(),
+			Kind: func() gwapiv1.Kind {
+				if backendRef.Kind == nil {
+					return "Service"
+				}
+				return *backendRef.Kind
+			}(),
+			Name:      backendRef.Name,
+			Namespace: NamespacePtr(NamespaceDerefOr(backendRef.Namespace, namespace)),
+		},
+		SectionName: func() *gwapiv1.SectionName {
+			if backendRef.Port != nil {
+				return SectionNamePtr(strconv.Itoa(int(*backendRef.Port)))
+			}
+			return nil
+		}(),
+	}
+	return ref
+}
diff --git a/adapter/internal/operator/gateway-api/secrets.go b/adapter/internal/operator/gateway-api/secrets.go
new file mode 100644
index 000000000..46b8a6e7f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/secrets.go
@@ -0,0 +1,153 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/crypto"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	corev1 "k8s.io/api/core/v1"
+	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+var (
+	ErrSecretExists = errors.New("skipped creating secret since it already exists")
+)
+
+// caCertificateKey is the key name for accessing TLS CA certificate bundles
+// in Kubernetes Secrets.
+const (
+	caCertificateKey = "ca.crt"
+	hmacSecretKey    = "hmac-secret"
+)
+
+func newSecret(secretType corev1.SecretType, name string, namespace string, data map[string][]byte) corev1.Secret {
+	return corev1.Secret{
+		Type: secretType,
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Secret",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+			Labels: map[string]string{
+				"control-plane": "envoy-gateway",
+			},
+		},
+		Data: data,
+	}
+}
+
+// CertsToSecret creates secrets in the provided namespace, in compact form, from the provided certs.
+func CertsToSecret(namespace string, certs *crypto.Certificates) []corev1.Secret {
+	return []corev1.Secret{
+		newSecret(
+			corev1.SecretTypeTLS,
+			"envoy-gateway",
+			namespace,
+			map[string][]byte{
+				caCertificateKey:        certs.CACertificate,
+				corev1.TLSCertKey:       certs.EnvoyGatewayCertificate,
+				corev1.TLSPrivateKeyKey: certs.EnvoyGatewayPrivateKey,
+			}),
+		newSecret(
+			corev1.SecretTypeTLS,
+			"envoy",
+			namespace,
+			map[string][]byte{
+				caCertificateKey:        certs.CACertificate,
+				corev1.TLSCertKey:       certs.EnvoyCertificate,
+				corev1.TLSPrivateKeyKey: certs.EnvoyPrivateKey,
+			}),
+		newSecret(
+			corev1.SecretTypeTLS,
+			"envoy-rate-limit",
+			namespace,
+			map[string][]byte{
+				caCertificateKey:        certs.CACertificate,
+				corev1.TLSCertKey:       certs.EnvoyRateLimitCertificate,
+				corev1.TLSPrivateKeyKey: certs.EnvoyRateLimitPrivateKey,
+			}),
+		newSecret(
+			corev1.SecretTypeOpaque,
+			"envoy-oidc-hmac",
+			namespace,
+			map[string][]byte{
+				hmacSecretKey: certs.OIDCHMACSecret,
+			}),
+	}
+}
+
+// CreateOrUpdateSecrets creates the provided secrets if they don't exist or updates
+// them if they do.
+func CreateOrUpdateSecrets(ctx context.Context, client client.Client, secrets []corev1.Secret, update bool) ([]corev1.Secret, error) {
+	var (
+		tidySecrets     []corev1.Secret
+		existingSecrets []string
+	)
+
+	for secret := range secrets {
+		secret := secrets[secret]
+		current := new(corev1.Secret)
+		key := utils.NamespacedName(&secret)
+		if err := client.Get(ctx, key, current); err != nil {
+			// Create if not found.
+			if kerrors.IsNotFound(err) {
+				if err := client.Create(ctx, &secret); err != nil {
+					return nil, fmt.Errorf("failed to create secret %s/%s: %w", secret.Namespace, secret.Name, err)
+				}
+			} else {
+				return nil, fmt.Errorf("failed to get secret %s/%s: %w", secret.Namespace, secret.Name, err)
+			}
+			// Update if current value is different and update arg is set.
+		} else {
+			if !update {
+				existingSecrets = append(existingSecrets, fmt.Sprintf("%s/%s", secret.Namespace, secret.Name))
+				continue
+			}
+			fmt.Println()
+
+			if !reflect.DeepEqual(secret.Data, current.Data) {
+				if err := client.Update(ctx, &secret); err != nil {
+					return nil, fmt.Errorf("failed to update secret %s/%s: %w", secret.Namespace, secret.Name, err)
+				}
+			}
+		}
+		tidySecrets = append(tidySecrets, secret)
+	}
+
+	if len(existingSecrets) > 0 {
+		return tidySecrets, fmt.Errorf("%v: %w;"+
+			"Either update the secrets manually or set overwriteControlPlaneCerts "+
+			"in the EnvoyGateway config", existingSecrets, ErrSecretExists)
+	}
+
+	return tidySecrets, nil
+}
diff --git a/adapter/internal/operator/gateway-api/secrets_test.go b/adapter/internal/operator/gateway-api/secrets_test.go
new file mode 100644
index 000000000..6715eae4b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/secrets_test.go
@@ -0,0 +1,114 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+var (
+	envoyGatewaySecret = corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "envoy-gateway",
+			Namespace: "apk",
+		},
+	}
+
+	envoySecret = corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "envoy",
+			Namespace: "apk",
+		},
+	}
+
+	envoyRateLimitSecret = corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "envoy-rate-limit",
+			Namespace: "apk",
+		},
+	}
+
+	oidcHMACSecret = corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "envoy-oidc-hmac",
+			Namespace: "apk",
+		},
+	}
+
+	existingSecretsWithoutHMAC = []client.Object{
+		&envoyGatewaySecret,
+		&envoySecret,
+		&envoyRateLimitSecret,
+	}
+
+	existingSecretsWithHMAC = []client.Object{
+		&envoyGatewaySecret,
+		&envoySecret,
+		&envoyRateLimitSecret,
+		&oidcHMACSecret,
+	}
+
+	SecretsToCreate = []corev1.Secret{
+		envoyGatewaySecret,
+		envoySecret,
+		envoyRateLimitSecret,
+		oidcHMACSecret,
+	}
+)
+
+func TestCreateSecretsWhenUpgrade(t *testing.T) {
+	t.Run("create HMAC secret when it does not exist", func(t *testing.T) {
+		cli := fakeclient.NewClientBuilder().WithObjects(existingSecretsWithoutHMAC...).Build()
+
+		created, err := CreateOrUpdateSecrets(context.Background(), cli, SecretsToCreate, false)
+		require.ErrorIs(t, err, ErrSecretExists)
+		require.Len(t, created, 1)
+		require.Equal(t, "envoy-oidc-hmac", created[0].Name)
+
+		err = cli.Get(context.Background(), client.ObjectKeyFromObject(&oidcHMACSecret), &corev1.Secret{})
+		require.NoError(t, err)
+	})
+
+	t.Run("skip HMAC secret when it exist", func(t *testing.T) {
+		cli := fakeclient.NewClientBuilder().WithObjects(existingSecretsWithHMAC...).Build()
+
+		created, err := CreateOrUpdateSecrets(context.Background(), cli, SecretsToCreate, false)
+		require.ErrorIs(t, err, ErrSecretExists)
+		require.Emptyf(t, created, "expected no secrets to be created, got %v", created)
+	})
+
+	t.Run("update secrets when they exist", func(t *testing.T) {
+		cli := fakeclient.NewClientBuilder().WithObjects(existingSecretsWithHMAC...).Build()
+
+		created, err := CreateOrUpdateSecrets(context.Background(), cli, SecretsToCreate, true)
+		require.NoError(t, err)
+		require.Len(t, created, 4)
+	})
+}
diff --git a/adapter/internal/operator/gateway-api/sort.go b/adapter/internal/operator/gateway-api/sort.go
new file mode 100644
index 000000000..eef7d3648
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/sort.go
@@ -0,0 +1,124 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"sort"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+)
+
+type XdsIRRoutes []*ir.HTTPRoute
+
+func (x XdsIRRoutes) Len() int      { return len(x) }
+func (x XdsIRRoutes) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
+func (x XdsIRRoutes) Less(i, j int) bool {
+
+	// 1. Sort based on path match type
+	// Exact > RegularExpression > PathPrefix
+	if x[i].PathMatch != nil && x[i].PathMatch.Exact != nil {
+		if x[j].PathMatch != nil {
+			if x[j].PathMatch.SafeRegex != nil {
+				return false
+			}
+			if x[j].PathMatch.Prefix != nil {
+				return false
+			}
+		}
+	}
+	if x[i].PathMatch != nil && x[i].PathMatch.SafeRegex != nil {
+		if x[j].PathMatch != nil {
+			if x[j].PathMatch.Exact != nil {
+				return true
+			}
+			if x[j].PathMatch.Prefix != nil {
+				return false
+			}
+		}
+	}
+	if x[i].PathMatch != nil && x[i].PathMatch.Prefix != nil {
+		if x[j].PathMatch != nil {
+			if x[j].PathMatch.Exact != nil {
+				return true
+			}
+			if x[j].PathMatch.SafeRegex != nil {
+				return true
+			}
+		}
+	}
+	// Equal case
+
+	// 2. Sort based on characters in a matching path.
+	pCountI := pathMatchCount(x[i].PathMatch)
+	pCountJ := pathMatchCount(x[j].PathMatch)
+	if pCountI < pCountJ {
+		return true
+	}
+	if pCountI > pCountJ {
+		return false
+	}
+	// Equal case
+
+	// 3. Sort based on the number of Header matches.
+	hCountI := len(x[i].HeaderMatches)
+	hCountJ := len(x[j].HeaderMatches)
+	if hCountI < hCountJ {
+		return true
+	}
+	if hCountI > hCountJ {
+		return false
+	}
+	// Equal case
+
+	// 4. Sort based on the number of Query param matches.
+	qCountI := len(x[i].QueryParamMatches)
+	qCountJ := len(x[j].QueryParamMatches)
+	return qCountI < qCountJ
+}
+
+// sortXdsIR sorts the xdsIR based on the match precedence
+// defined in the Gateway API spec.
+// https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.HTTPRouteRule
+func sortXdsIRMap(xdsIR XdsIRMap) {
+	for _, irItem := range xdsIR {
+		for _, http := range irItem.HTTP {
+			// descending order
+			sort.Sort(sort.Reverse(XdsIRRoutes(http.Routes)))
+		}
+	}
+}
+
+func pathMatchCount(pathMatch *ir.StringMatch) int {
+	if pathMatch != nil {
+		if pathMatch.Exact != nil {
+			return len(*pathMatch.Exact)
+		}
+		if pathMatch.SafeRegex != nil {
+			return len(*pathMatch.SafeRegex)
+		}
+		if pathMatch.Prefix != nil {
+			return len(*pathMatch.Prefix)
+		}
+	}
+	return 0
+}
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.in.yaml
new file mode 100644
index 000000000..391eeb060
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.in.yaml
@@ -0,0 +1,137 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: gateway-btls
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: httproute-btls
+      namespace: envoy-gateway
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-btls
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: http-backend
+              namespace: backends
+              port: 8080
+
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      name: refg-route-svc
+      namespace: backends
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: BackendTLSPolicy
+          namespace: policies
+      to:
+        - group: ""
+          kind: Service
+
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: http-backend
+      namespace: backends
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+          targetPort: 8080
+
+
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: backends
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "10.244.0.11"
+        conditions:
+          ready: true
+
+configMaps:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: ca-cmap
+      namespace: policies
+    data:
+      ca.crt: |
+        -----BEGIN CERTIFICATE-----
+        MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
+        BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
+        MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
+        A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
+        1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
+        yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
+        kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
+        Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
+        ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
+        bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
+        6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
+        BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
+        2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
+        i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
+        A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
+        d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
+        3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
+        -----END CERTIFICATE-----
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls
+      namespace: policies
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        namespace: backends
+        sectionName: "8080"
+      tls:
+        caCertRefs:
+          - name: ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: example.com
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.out.yaml
new file mode 100644
index 000000000..bda2c196a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.out.yaml
@@ -0,0 +1,169 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls
+    namespace: policies
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      namespace: backends
+      sectionName: "8080"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: example.com
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: BackendTLSPolicy is Accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-btls
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-btls
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-btls
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: http-backend
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-btls:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-btls/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-btls
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-btls
+xdsIR:
+  envoy-gateway/gateway-btls:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-btls/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.244.0.11
+              port: 8080
+            protocol: HTTP
+            tls:
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/policies-ca
+              sni: example.com
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.in.yaml
new file mode 100644
index 000000000..f935b78dc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.in.yaml
@@ -0,0 +1,137 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: gateway-btls
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: httproute-btls
+      namespace: envoy-gateway
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-btls
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: http-backend
+              namespace: default
+              port: 8080
+
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      name: refg-route-svc
+      namespace: default
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: BackendTLSPolicy
+          namespace: default
+      to:
+        - group: ""
+          kind: Service
+
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: http-backend
+      namespace: default
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+          targetPort: 8080
+
+
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: default
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "10.244.0.11"
+        conditions:
+          ready: true
+
+
+configMaps:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: ca-cmap
+      namespace: default
+    data:
+      ca.crt: |
+        -----BEGIN CERTIFICATE-----
+        MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
+        BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
+        MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
+        A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
+        1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
+        yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
+        kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
+        Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
+        ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
+        bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
+        6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
+        BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
+        2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
+        i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
+        A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
+        d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
+        3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
+        -----END CERTIFICATE-----
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls
+      namespace: default
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        sectionName: "8080"
+      tls:
+        caCertRefs:
+          - name: ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: example.com
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.out.yaml
new file mode 100644
index 000000000..21375f079
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.out.yaml
@@ -0,0 +1,168 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls
+    namespace: default
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      sectionName: "8080"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: example.com
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: BackendTLSPolicy is Accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-btls
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-btls
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-btls
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: http-backend
+        namespace: default
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-btls:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-btls/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-btls
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-btls
+xdsIR:
+  envoy-gateway/gateway-btls:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-btls/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.244.0.11
+              port: 8080
+            protocol: HTTP
+            tls:
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/default-ca
+              sni: example.com
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.in.yaml
new file mode 100644
index 000000000..d11c1a5f2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.in.yaml
@@ -0,0 +1,119 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: gateway-btls
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: httproute-btls
+      namespace: envoy-gateway
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-btls
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: http-backend
+              namespace: backends
+              port: 8080
+
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      name: refg-route-svc
+      namespace: backends
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: BackendTLSPolicy
+          namespace: policies
+      to:
+        - group: ""
+          kind: Service
+
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: http-backend
+      namespace: backends
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+          targetPort: 8080
+
+
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: backends
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "10.244.0.11"
+        conditions:
+          ready: true
+
+configMaps:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: no-ca-cmap
+      namespace: policies
+    data:
+      garbage.crt: |
+        itsAllGarbage
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls
+      namespace: policies
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        namespace: backends
+        sectionName: "8080"
+      tls:
+        caCertRefs:
+          - name: no-ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: example.com
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.out.yaml
new file mode 100644
index 000000000..0d234e3ca
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.out.yaml
@@ -0,0 +1,164 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls
+    namespace: policies
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      namespace: backends
+      sectionName: "8080"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: no-ca-cmap
+      hostname: example.com
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: No ca found in configmap no-ca-cmap
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-btls
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-btls
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-btls
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: http-backend
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-btls:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-btls/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-btls
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-btls
+xdsIR:
+  envoy-gateway/gateway-btls:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-btls/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.244.0.11
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.in.yaml
new file mode 100644
index 000000000..88fb94bc1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.in.yaml
@@ -0,0 +1,105 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: gateway-btls
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: httproute-btls
+      namespace: envoy-gateway
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-btls
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: http-backend
+              namespace: default
+              port: 8080
+
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      name: refg-route-svc
+      namespace: default
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: BackendTLSPolicy
+          namespace: default
+      to:
+        - group: ""
+          kind: Service
+
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: http-backend
+      namespace: default
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+          targetPort: 8080
+
+
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: default
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "10.244.0.11"
+        conditions:
+          ready: true
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls
+      namespace: default
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        sectionName: "8080"
+      tls:
+        wellKnownCACerts: System
+        hostname: example.com
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.out.yaml
new file mode 100644
index 000000000..57bc73c40
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.out.yaml
@@ -0,0 +1,163 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls
+    namespace: default
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      sectionName: "8080"
+    tls:
+      hostname: example.com
+      wellKnownCACerts: System
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: BackendTLSPolicy is Accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-btls
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-btls
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-btls
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: http-backend
+        namespace: default
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-btls:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-btls/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-btls
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-btls
+xdsIR:
+  envoy-gateway/gateway-btls:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-btls/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.244.0.11
+              port: 8080
+            protocol: HTTP
+            tls:
+              sni: example.com
+              useSystemTrustStore: true
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.in.yaml
new file mode 100644
index 000000000..f773f2008
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.in.yaml
@@ -0,0 +1,134 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: gateway-btls
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: httproute-btls
+      namespace: envoy-gateway
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-btls
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: http-backend
+              namespace: backends
+              port: 8080
+
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      name: refg-route-svc
+      namespace: backends
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+      to:
+        - group: ""
+          kind: Service
+
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: http-backend
+      namespace: backends
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+          targetPort: 8080
+
+
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: backends
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "10.244.0.11"
+        conditions:
+          ready: true
+
+configMaps:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: ca-cmap
+      namespace: policies
+    data:
+      ca.crt: |
+        -----BEGIN CERTIFICATE-----
+        MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
+        BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
+        MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
+        A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
+        1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
+        yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
+        kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
+        Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
+        ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
+        bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
+        6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
+        BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
+        2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
+        i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
+        A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
+        d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
+        3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
+        -----END CERTIFICATE-----
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls
+      namespace: policies
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        namespace: backends
+        sectionName: "8080"
+      tls:
+        caCertRefs:
+          - name: ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: example.com
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.out.yaml
new file mode 100755
index 000000000..2cc528d75
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.out.yaml
@@ -0,0 +1,165 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls
+    namespace: policies
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      namespace: backends
+      sectionName: "8080"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: example.com
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: target ref to Service backends/http-backend not permitted by any
+          ReferenceGrant
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-btls
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-btls
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-btls
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: http-backend
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-btls:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-btls/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-btls
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-btls
+xdsIR:
+  envoy-gateway/gateway-btls:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-btls/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.244.0.11
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.in.yaml
new file mode 100644
index 000000000..ea9b2f65a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.in.yaml
@@ -0,0 +1,89 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/bar"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    loadBalancer:
+      type: Random
+    timeout:
+      tcp:
+        connectTimeout: 20s
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    loadBalancer:
+      type: ConsistentHash
+      consistentHash:
+        type: SourceIP
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.out.yaml
new file mode 100755
index 000000000..4b9a5428d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.out.yaml
@@ -0,0 +1,271 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-1
+    namespace: default
+  spec:
+    loadBalancer:
+      consistentHash:
+        type: SourceIP
+      type: ConsistentHash
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-1
+    namespace: envoy-gateway
+  spec:
+    loadBalancer:
+      type: Random
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22s
+      tcp:
+        connectTimeout: 20s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other backendTrafficPolicies
+          for these routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        loadBalancer:
+          consistentHash:
+            sourceIP: true
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        loadBalancer:
+          random: {}
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
+        timeout:
+          http:
+            connectionIdleTimeout: 21s
+            maxConnectionDuration: 22s
+          tcp:
+            connectTimeout: 20s
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.in.yaml
new file mode 100644
index 000000000..ed13bb09c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.in.yaml
@@ -0,0 +1,207 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1-as-well
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-unknown-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: unknown-gateway
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: not-same-namespace-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: not-same-namespace-gateway
+      namespace: another-namespace
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-httproute-in-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: also-target-httproute-in-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-grpcroute-in-gateway-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-unknown-httproute
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: unknown-httproute
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: not-same-namespace-httproute
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: not-same-namespace-httproute
+      namespace: another-namespace
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    namespace: another-namespace
+    name: not-same-namespace-httproute
+  spec:
+    parentRefs:
+    - namespace: another-namespace
+      name: not-same-namespace-gateway
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: envoy-gateway
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+    rules:
+    - matches:
+      - headers:
+        - type: Exact
+          name: magic
+          value: foo
+      backendRefs:
+      - name: service-1
+        port: 8080
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      protocol: HTTPS
+      port: 443
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: tcp
+      protocol: TCP
+      port: 53
+      allowedRoutes:
+        namespaces:
+          from: Same
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: another-namespace
+    name: not-same-namespace-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.out.yaml
new file mode 100644
index 000000000..f0ea790e4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.out.yaml
@@ -0,0 +1,621 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-httproute-in-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: also-target-httproute-in-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Unable to target HTTPRoute, another BackendTrafficPolicy has already
+          attached to it
+        reason: Conflicted
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-grpcroute-in-gateway-2
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-unknown-httproute
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: unknown-httproute
+      namespace: envoy-gateway
+  status:
+    ancestors: null
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: not-same-namespace-httproute
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: not-same-namespace-httproute
+      namespace: another-namespace
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: not-same-namespace-gateway
+        namespace: another-namespace
+      conditions:
+      - lastTransitionTime: null
+        message: Namespace:envoy-gateway TargetRef.Namespace:another-namespace, BackendTrafficPolicy
+          can only target a resource in the same namespace.
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other backendTrafficPolicies
+          for these routes: [envoy-gateway/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1-as-well
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Unable to target Gateway, another BackendTrafficPolicy has already
+          attached to it
+        reason: Conflicted
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-unknown-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: unknown-gateway
+      namespace: envoy-gateway
+  status:
+    ancestors: null
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: not-same-namespace-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: not-same-namespace-gateway
+      namespace: another-namespace
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: not-same-namespace-gateway
+        namespace: another-namespace
+      conditions:
+      - lastTransitionTime: null
+        message: Namespace:envoy-gateway TargetRef.Namespace:another-namespace, BackendTrafficPolicy
+          can only target a resource in the same namespace.
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: https
+      port: 443
+      protocol: HTTPS
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: tcp
+      port: 53
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must have TLS set when protocol is HTTPS.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: https
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: not-same-namespace-gateway
+    namespace: another-namespace
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: magic
+          type: Exact
+          value: foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: not-same-namespace-httproute
+    namespace: another-namespace
+  spec:
+    parentRefs:
+    - name: not-same-namespace-gateway
+      namespace: another-namespace
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service another-namespace/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: not-same-namespace-gateway
+        namespace: another-namespace
+infraIR:
+  another-namespace/not-same-namespace-gateway:
+    proxy:
+      listeners:
+      - address: null
+        name: another-namespace/not-same-namespace-gateway/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: not-same-namespace-gateway
+          apk.wso2.com/owning-gateway-namespace: another-namespace
+      name: another-namespace/not-same-namespace-gateway
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-2/tcp
+        ports:
+        - containerPort: 10053
+          name: tcp
+          protocol: TCP
+          servicePort: 53
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  another-namespace/not-same-namespace-gateway:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: another-namespace/not-same-namespace-gateway/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        headerMatches:
+        - distinct: false
+          exact: foo
+          name: magic
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/envoy-gateway/grpcroute-1/rule/0/match/0/*
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.in.yaml
new file mode 100644
index 000000000..8104c47f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.in.yaml
@@ -0,0 +1,135 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/route2"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+      namespace: envoy-gateway
+    faultInjection:
+      abort:
+        httpStatus: 14
+        percentage: 0.01
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    faultInjection:
+      abort:
+        httpStatus: 500
+        percentage: 100
+      delay:
+        fixedDelay: 5.4s
+        percentage: 80
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-grpcroute
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: default
+    faultInjection:
+      abort:
+        grpcStatus: 14
+        percentage: 100
+      delay:
+        fixedDelay: 5.4s
+        percentage: 80
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
new file mode 100644
index 000000000..401442b05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
@@ -0,0 +1,430 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    faultInjection:
+      abort:
+        httpStatus: 500
+        percentage: 100
+      delay:
+        fixedDelay: 5.4s
+        percentage: 80
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-grpcroute
+    namespace: default
+  spec:
+    faultInjection:
+      abort:
+        grpcStatus: 14
+        percentage: 100
+      delay:
+        fixedDelay: 5.4s
+        percentage: 80
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    faultInjection:
+      abort:
+        httpStatus: 14
+        percentage: 0.01
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other backendTrafficPolicies
+          for these routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /route2
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        faultInjection:
+          abort:
+            grpcStatus: 14
+            percentage: 100
+          delay:
+            fixedDelay: 5.4s
+            percentage: 80
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        faultInjection:
+          abort:
+            httpStatus: 14
+            percentage: 0.01
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /route2
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        faultInjection:
+          abort:
+            httpStatus: 500
+            percentage: 100
+          delay:
+            fixedDelay: 5.4s
+            percentage: 80
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.in.yaml
new file mode 100644
index 000000000..589e63b24
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.in.yaml
@@ -0,0 +1,123 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-2
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+grpcRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: GRPCRoute
+    metadata:
+      namespace: default
+      name: grpcroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - apk.wso2.com
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-2
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-2
+    spec:
+      hostnames:
+        - apk.wso2.com
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-2
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/foo"
+          backendRefs:
+            - name: service-1
+              port: 8080
+backendTrafficPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: BackendTrafficPolicy
+    metadata:
+      namespace: envoy-gateway
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      circuitBreaker:
+        maxConnections: -1
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: BackendTrafficPolicy
+    metadata:
+      namespace: default
+      name: policy-for-route
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+        namespace: default
+      circuitBreaker:
+        maxRequestsPerConnection: -1
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: BackendTrafficPolicy
+    metadata:
+      namespace: default
+      name: policy-for-route2
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-2
+        namespace: default
+      circuitBreaker:
+        maxParallelRetries: -1
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
new file mode 100644
index 000000000..4197b5961
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
@@ -0,0 +1,394 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    circuitBreaker:
+      maxRequestsPerConnection: -1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: 'CircuitBreaker: invalid MaxRequestsPerConnection value -1'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route2
+    namespace: default
+  spec:
+    circuitBreaker:
+      maxParallelRetries: -1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: 'CircuitBreaker: invalid MaxParallelRetries value -1'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    circuitBreaker:
+      maxConnections: -1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'CircuitBreaker: invalid MaxConnections value -1'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.in.yaml
new file mode 100644
index 000000000..c1d23a03a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.in.yaml
@@ -0,0 +1,99 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    circuitBreaker:
+      maxConnections: 2048
+      maxPendingRequests: 1
+      maxParallelRequests: 4294967295
+      maxParallelRetries: 1024
+      maxRequestsPerConnection: 1
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    circuitBreaker:
+      maxConnections: 42
+      maxPendingRequests: 42
+      maxParallelRequests: 42
+      maxParallelRetries: 24
+      maxRequestsPerConnection: 42
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
new file mode 100644
index 000000000..152901578
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
@@ -0,0 +1,328 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    circuitBreaker:
+      maxConnections: 42
+      maxParallelRequests: 42
+      maxParallelRetries: 24
+      maxPendingRequests: 42
+      maxRequestsPerConnection: 42
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    circuitBreaker:
+      maxConnections: 2048
+      maxParallelRequests: 4294967295
+      maxParallelRetries: 1024
+      maxPendingRequests: 1
+      maxRequestsPerConnection: 1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        circuitBreaker:
+          maxConnections: 2048
+          maxParallelRequests: 4294967295
+          maxParallelRetries: 1024
+          maxPendingRequests: 1
+          maxRequestsPerConnection: 1
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        circuitBreaker:
+          maxConnections: 42
+          maxParallelRequests: 42
+          maxParallelRetries: 24
+          maxPendingRequests: 42
+          maxRequestsPerConnection: 42
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.in.yaml
new file mode 100644
index 000000000..3ba0127fa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.in.yaml
@@ -0,0 +1,239 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/v2"
+      backendRefs:
+      - name: service-2
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-3
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/v3"
+      backendRefs:
+      - name: service-3
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    healthCheck:
+      active:
+        timeout: "500ms"
+        interval: "3s"
+        unhealthyThreshold: 3
+        healthyThreshold: 1
+        type: HTTP
+        http:
+          path: "/healthz"
+          method: "GET"
+          expectedStatuses:
+          - 200
+          - 300
+          expectedResponse:
+            type: Binary
+            binary: RXZlcnl0aGluZyBPSw==
+      passive:
+        baseEjectionTime: 160s
+        interval: 2s
+        maxEjectionPercent: 100
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    healthCheck:
+      active:
+        timeout: "1s"
+        interval: "5s"
+        unhealthyThreshold: 3
+        healthyThreshold: 3
+        type: HTTP
+        http:
+          path: "/healthz"
+          method: "GET"
+          expectedStatuses:
+          - 200
+          - 201
+          expectedResponse:
+            type: Text
+            text: pong
+      passive:
+        baseEjectionTime: 150s
+        interval: 1s
+        maxEjectionPercent: 100
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+    healthCheck:
+      active:
+        timeout: "1s"
+        interval: "5s"
+        unhealthyThreshold: 3
+        healthyThreshold: 3
+        type: TCP
+        tcp:
+          send:
+            type: Text
+            text: ping
+          receive:
+            type: Text
+            text: pong
+      passive:
+        baseEjectionTime: 10s
+        interval: 10s
+        maxEjectionPercent: 10
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-3
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-3
+      namespace: default
+    healthCheck:
+      active:
+        timeout: 1s
+        interval: 3s
+        unhealthyThreshold: 3
+        healthyThreshold: 1
+        type: TCP
+        tcp:
+          send:
+            type: Binary
+            binary: cGluZw==
+          receive:
+            type: Binary
+            binary: RXZlcnl0aGluZyBPSw==
+      passive:
+        baseEjectionTime: 160s
+        interval: 8ms
+        maxEjectionPercent: 11
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
new file mode 100644
index 000000000..75d9cce14
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
@@ -0,0 +1,648 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-1
+    namespace: default
+  spec:
+    healthCheck:
+      active:
+        healthyThreshold: 3
+        http:
+          expectedResponse:
+            text: pong
+            type: Text
+          expectedStatuses:
+          - 200
+          - 201
+          method: GET
+          path: /healthz
+        interval: 5s
+        timeout: 1s
+        type: HTTP
+        unhealthyThreshold: 3
+      passive:
+        baseEjectionTime: 2m30s
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        interval: 1s
+        maxEjectionPercent: 100
+        splitExternalLocalOriginErrors: false
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-2
+    namespace: default
+  spec:
+    healthCheck:
+      active:
+        healthyThreshold: 3
+        interval: 5s
+        tcp:
+          receive:
+            text: pong
+            type: Text
+          send:
+            text: ping
+            type: Text
+        timeout: 1s
+        type: TCP
+        unhealthyThreshold: 3
+      passive:
+        baseEjectionTime: 10s
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        interval: 10s
+        maxEjectionPercent: 10
+        splitExternalLocalOriginErrors: false
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-3
+    namespace: default
+  spec:
+    healthCheck:
+      active:
+        healthyThreshold: 1
+        interval: 3s
+        tcp:
+          receive:
+            binary: RXZlcnl0aGluZyBPSw==
+            type: Binary
+          send:
+            binary: cGluZw==
+            type: Binary
+        timeout: 1s
+        type: TCP
+        unhealthyThreshold: 3
+      passive:
+        baseEjectionTime: 2m40s
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        interval: 8ms
+        maxEjectionPercent: 11
+        splitExternalLocalOriginErrors: false
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-3
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    healthCheck:
+      active:
+        healthyThreshold: 1
+        http:
+          expectedResponse:
+            binary: RXZlcnl0aGluZyBPSw==
+            type: Binary
+          expectedStatuses:
+          - 200
+          - 300
+          method: GET
+          path: /healthz
+        interval: 3s
+        timeout: 500ms
+        type: HTTP
+        unhealthyThreshold: 3
+      passive:
+        baseEjectionTime: 2m40s
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        interval: 2s
+        maxEjectionPercent: 100
+        splitExternalLocalOriginErrors: false
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 3
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /v2
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-3
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-3
+        port: 8080
+      matches:
+      - path:
+          value: /v3
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        healthCheck:
+          active:
+            healthyThreshold: 1
+            http:
+              expectedResponse:
+                binary: RXZlcnl0aGluZyBPSw==
+              expectedStatuses:
+              - 200
+              - 300
+              host: '*'
+              method: GET
+              path: /healthz
+            interval: 3s
+            timeout: 500ms
+            unhealthyThreshold: 3
+          passive:
+            baseEjectionTime: 2m40s
+            consecutive5XxErrors: 5
+            consecutiveGatewayErrors: 0
+            consecutiveLocalOriginFailures: 5
+            interval: 2s
+            maxEjectionPercent: 100
+            splitExternalLocalOriginErrors: false
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        healthCheck:
+          active:
+            healthyThreshold: 3
+            interval: 5s
+            tcp:
+              receive:
+                text: pong
+              send:
+                text: ping
+            timeout: 1s
+            unhealthyThreshold: 3
+          passive:
+            baseEjectionTime: 10s
+            consecutive5XxErrors: 5
+            consecutiveGatewayErrors: 0
+            consecutiveLocalOriginFailures: 5
+            interval: 10s
+            maxEjectionPercent: 10
+            splitExternalLocalOriginErrors: false
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v2
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-3/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        healthCheck:
+          active:
+            healthyThreshold: 1
+            interval: 3s
+            tcp:
+              receive:
+                binary: RXZlcnl0aGluZyBPSw==
+              send:
+                binary: cGluZw==
+            timeout: 1s
+            unhealthyThreshold: 3
+          passive:
+            baseEjectionTime: 2m40s
+            consecutive5XxErrors: 5
+            consecutiveGatewayErrors: 0
+            consecutiveLocalOriginFailures: 5
+            interval: 8ms
+            maxEjectionPercent: 11
+            splitExternalLocalOriginErrors: false
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-3/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v3
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        healthCheck:
+          active:
+            healthyThreshold: 3
+            http:
+              expectedResponse:
+                text: pong
+              expectedStatuses:
+              - 200
+              - 201
+              host: apk.wso2.com
+              method: GET
+              path: /healthz
+            interval: 5s
+            timeout: 1s
+            unhealthyThreshold: 3
+          passive:
+            baseEjectionTime: 2m30s
+            consecutive5XxErrors: 5
+            consecutiveGatewayErrors: 0
+            consecutiveLocalOriginFailures: 5
+            interval: 1s
+            maxEjectionPercent: 100
+            splitExternalLocalOriginErrors: false
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.in.yaml
new file mode 100644
index 000000000..5744e6813
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.in.yaml
@@ -0,0 +1,142 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/test2"
+      backendRefs:
+      - name: service-2
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    loadBalancer:
+      type: Random
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    loadBalancer:
+      type: ConsistentHash
+      consistentHash:
+        type: SourceIP
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+      namespace: envoy-gateway
+    loadBalancer:
+      type: RoundRobin
+      slowStart:
+        window: 300s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+    loadBalancer:
+      type: LeastRequest
+      slowStart:
+        window: 300s
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
new file mode 100644
index 000000000..4fbeddb3c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
@@ -0,0 +1,443 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    loadBalancer:
+      consistentHash:
+        type: SourceIP
+      type: ConsistentHash
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route2
+    namespace: default
+  spec:
+    loadBalancer:
+      slowStart:
+        window: 5m0s
+      type: LeastRequest
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    loadBalancer:
+      type: Random
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway2
+    namespace: envoy-gateway
+  spec:
+    loadBalancer:
+      slowStart:
+        window: 5m0s
+      type: RoundRobin
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other backendTrafficPolicies
+          for these routes: [default/httproute-1 default/httproute-2]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /test2
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        loadBalancer:
+          random: {}
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        loadBalancer:
+          leastRequest:
+            slowStart:
+              window: 5m0s
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /test2
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        loadBalancer:
+          consistentHash:
+            sourceIP: true
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.in.yaml
new file mode 100644
index 000000000..8b3e60576
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.in.yaml
@@ -0,0 +1,71 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Local
+      local:
+        rules:    # No Rule without selector is specified, so int32 max is used as default.
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
new file mode 100644
index 000000000..82bec953e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
@@ -0,0 +1,213 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      local:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
+      type: Local
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        rateLimit:
+          local:
+            default:
+              requests: 4294967295
+              unit: Second
+            rules:
+            - headerMatches:
+              - distinct: false
+                exact: one
+                name: x-user-id
+              - distinct: false
+                exact: foo
+                name: x-org-id
+              limit:
+                requests: 10
+                unit: Hour
+            - cidrMatch:
+                cidr: 192.168.0.0/16
+                distinct: false
+                ipv6: false
+                maskLen: 16
+              headerMatches:
+              - distinct: false
+                exact: two
+                name: x-user-id
+              - distinct: false
+                exact: bar
+                name: x-org-id
+              limit:
+                requests: 10
+                unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.in.yaml
new file mode 100644
index 000000000..9d2345eb2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.in.yaml
@@ -0,0 +1,74 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Local
+      local:
+        rules:
+        - limit:
+            requests: 1000
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute    # Local rateLimit rule limit unit is not a multiple of the default limit unit.
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
new file mode 100644
index 000000000..4abdf1c81
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
@@ -0,0 +1,186 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      local:
+        rules:
+        - limit:
+            requests: 1000
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
+      type: Local
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'RateLimit: local rateLimit rule limit unit must be a multiple of
+          the default limit unit'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.in.yaml
new file mode 100644
index 000000000..4ce51ffbd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.in.yaml
@@ -0,0 +1,71 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Local
+      local:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml
new file mode 100644
index 000000000..2e5bc0d3b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml
@@ -0,0 +1,182 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      local:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
+      type: Local
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'RateLimit: local rateLimit does not support distinct HeaderMatch'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.in.yaml
new file mode 100644
index 000000000..ac31643f8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.in.yaml
@@ -0,0 +1,77 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Local
+      local:
+        rules:
+        - limit:    # There are two Rule without selector, so this is invalid.
+            requests: 10
+            unit: Minute
+        - limit:
+            requests: 20
+            unit: Minute
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
new file mode 100644
index 000000000..8b1a6ef2d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
@@ -0,0 +1,189 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      local:
+        rules:
+        - limit:
+            requests: 10
+            unit: Minute
+        - limit:
+            requests: 20
+            unit: Minute
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
+      type: Local
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'RateLimit: local rateLimit can not have more than one rule without
+          clientSelectors'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.in.yaml
new file mode 100644
index 000000000..99a4608cc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.in.yaml
@@ -0,0 +1,74 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Local
+      local:
+        rules:
+        - limit:    # The Rule without selector is used as default
+            requests: 10
+            unit: Minute
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
new file mode 100644
index 000000000..a5f92bcc2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
@@ -0,0 +1,216 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      local:
+        rules:
+        - limit:
+            requests: 10
+            unit: Minute
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
+      type: Local
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        rateLimit:
+          local:
+            default:
+              requests: 10
+              unit: Minute
+            rules:
+            - headerMatches:
+              - distinct: false
+                exact: one
+                name: x-user-id
+              - distinct: false
+                exact: foo
+                name: x-org-id
+              limit:
+                requests: 10
+                unit: Hour
+            - cidrMatch:
+                cidr: 192.168.0.0/16
+                distinct: false
+                ipv6: false
+                maskLen: 16
+              headerMatches:
+              - distinct: false
+                exact: two
+                name: x-user-id
+              - distinct: false
+                exact: bar
+                name: x-org-id
+              limit:
+                requests: 10
+                unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.in.yaml
new file mode 100644
index 000000000..582a4e05b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.in.yaml
@@ -0,0 +1,91 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    proxyProtocol:
+      version: V1
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    proxyProtocol:
+      version: V2
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
new file mode 100644
index 000000000..f41eecc30
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
@@ -0,0 +1,312 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    proxyProtocol:
+      version: V2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    proxyProtocol:
+      version: V1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        proxyProtocol:
+          version: V1
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        proxyProtocol:
+          version: V2
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.in.yaml
new file mode 100644
index 000000000..18dfda14b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Global
+      global:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              type: RegularExpression
+              value: "*.illegal.regex"
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
new file mode 100644
index 000000000..46444f14d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
@@ -0,0 +1,164 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      global:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              type: RegularExpression
+              value: '*.illegal.regex'
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
+      type: Global
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'RateLimit: regex "*.illegal.regex" is invalid: error parsing regexp:
+          missing argument to repetition operator: `*`'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.in.yaml
new file mode 100644
index 000000000..1e075f595
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.in.yaml
@@ -0,0 +1,111 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Global
+      global:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    rateLimit:
+      type: Global
+      global:
+        rules:
+        - clientSelectors:
+          - sourceCIDR:
+              type: "Distinct"
+              value: 192.168.0.0/16
+          limit:
+            requests: 20
+            unit: Hour
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
new file mode 100644
index 000000000..1d185ce01
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
@@ -0,0 +1,352 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    rateLimit:
+      global:
+        rules:
+        - clientSelectors:
+          - sourceCIDR:
+              type: Distinct
+              value: 192.168.0.0/16
+          limit:
+            requests: 20
+            unit: Hour
+      type: Global
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      global:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
+      type: Global
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        rateLimit:
+          global:
+            rules:
+            - headerMatches:
+              - distinct: false
+                exact: one
+                name: x-user-id
+              - distinct: true
+                name: x-org-id
+              limit:
+                requests: 10
+                unit: Hour
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        rateLimit:
+          global:
+            rules:
+            - cidrMatch:
+                cidr: 192.168.0.0/16
+                distinct: true
+                ipv6: false
+                maskLen: 16
+              headerMatches: []
+              limit:
+                requests: 20
+                unit: Hour
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.in.yaml
new file mode 100644
index 000000000..b1554fcf3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.in.yaml
@@ -0,0 +1,110 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    retry:
+      retryOn:
+        triggers:
+        - cancelled
+      perRetry:
+        timeout: 250ms
+        backoff:
+          baseInterval: 100ms
+          maxInterval: 10s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    retry:
+      numRetries: 5
+      retryOn:
+        httpStatusCodes:
+        - 429
+        - 503
+        triggers:
+        - connect-failure
+        - retriable-status-codes
+      perRetry:
+        timeout: 250ms
+        backoff:
+          baseInterval: 100ms
+          maxInterval: 10s
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.out.yaml
new file mode 100644
index 000000000..064910c07
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.out.yaml
@@ -0,0 +1,350 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    retry:
+      numRetries: 5
+      perRetry:
+        backOff:
+          baseInterval: 100ms
+          maxInterval: 10s
+        timeout: 250ms
+      retryOn:
+        httpStatusCodes:
+        - 429
+        - 503
+        triggers:
+        - connect-failure
+        - retriable-status-codes
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    retry:
+      perRetry:
+        backOff:
+          baseInterval: 100ms
+          maxInterval: 10s
+        timeout: 250ms
+      retryOn:
+        triggers:
+        - cancelled
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        retry:
+          perRetry:
+            backOff:
+              baseInterval: 100ms
+              maxInterval: 10s
+            timeout: 250ms
+          retryOn:
+            triggers:
+            - cancelled
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        retry:
+          numRetries: 5
+          perRetry:
+            backOff:
+              baseInterval: 100ms
+              maxInterval: 10s
+            timeout: 250ms
+          retryOn:
+            httpStatusCodes:
+            - 429
+            - 503
+            triggers:
+            - connect-failure
+            - retriable-status-codes
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.in.yaml
new file mode 100644
index 000000000..5bba0fd43
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.in.yaml
@@ -0,0 +1,70 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: default
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: default
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-httproute-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    circuitBreaker:
+      maxConnections: 2048
+      maxPendingRequests: 1
+      maxParallelRequests: 4294967295
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
new file mode 100644
index 000000000..22ebc5603
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
@@ -0,0 +1,224 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-httproute-1
+    namespace: default
+  spec:
+    circuitBreaker:
+      maxConnections: 2048
+      maxParallelRequests: 4294967295
+      maxPendingRequests: 1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        circuitBreaker:
+          maxConnections: 2048
+          maxParallelRequests: 4294967295
+          maxPendingRequests: 1
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.in.yaml
new file mode 100644
index 000000000..4587b0518
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.in.yaml
@@ -0,0 +1,95 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    tcpKeepalive:
+      probes: 3
+      idleTime: 20m
+      interval: 60s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    tcpKeepalive:
+      probes: 6
+      idleTime: 10s
+      interval: 30m
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
new file mode 100644
index 000000000..4c90cb268
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
@@ -0,0 +1,320 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    tcpKeepalive:
+      idleTime: 10s
+      interval: 30m
+      probes: 6
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    tcpKeepalive:
+      idleTime: 20m
+      interval: 60s
+      probes: 3
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        tcpKeepalive:
+          idleTime: 1200
+          interval: 60
+          probes: 3
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        tcpKeepalive:
+          idleTime: 10
+          interval: 1800
+          probes: 6
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.in.yaml
new file mode 100644
index 000000000..62ff310c3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.in.yaml
@@ -0,0 +1,49 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22mib
+      tcp:
+        connectTimeout: 20s
+
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
new file mode 100644
index 000000000..fa8ae48d6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
@@ -0,0 +1,155 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22mib
+      tcp:
+        connectTimeout: 20s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'Timeout: invalid MaxConnectionDuration value 22mib'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.in.yaml
new file mode 100644
index 000000000..14abe58a7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.in.yaml
@@ -0,0 +1,99 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      tcp:
+        connectTimeout: 15s
+      http:
+        connectionIdleTimeout: 16s
+        maxConnectionDuration: 17s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      tcp:
+        connectTimeout: 20s
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22s
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.out.yaml
new file mode 100644
index 000000000..508f965d8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.out.yaml
@@ -0,0 +1,328 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22s
+      tcp:
+        connectTimeout: 20s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      http:
+        connectionIdleTimeout: 16s
+        maxConnectionDuration: 17s
+      tcp:
+        connectTimeout: 15s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        timeout:
+          http:
+            connectionIdleTimeout: 16s
+            maxConnectionDuration: 17s
+          tcp:
+            connectTimeout: 15s
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        timeout:
+          http:
+            connectionIdleTimeout: 21s
+            maxConnectionDuration: 22s
+          tcp:
+            connectTimeout: 20s
diff --git a/adapter/internal/operator/gateway-api/testdata/disable-accesslog.in.yaml b/adapter/internal/operator/gateway-api/testdata/disable-accesslog.in.yaml
new file mode 100644
index 000000000..0987579b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/disable-accesslog.in.yaml
@@ -0,0 +1,73 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        disable: true
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/disable-accesslog.out.yaml b/adapter/internal/operator/gateway-api/testdata/disable-accesslog.out.yaml
new file mode 100644
index 000000000..61c561c06
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/disable-accesslog.out.yaml
@@ -0,0 +1,130 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              disable: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.in.yaml
new file mode 100644
index 000000000..43b3279af
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.in.yaml
@@ -0,0 +1,35 @@
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway-2
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.out.yaml
new file mode 100644
index 000000000..4d89fe308
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.out.yaml
@@ -0,0 +1,83 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - name: edit-conn-buffer-bytes
+      namespace: envoy-gateway-2
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: Namespace:envoy-gateway-2 TargetRef.Namespace:envoy-gateway, EnvoyPatchPolicy
+            can only target a Gateway in the same namespace.
+          reason: Invalid
+          status: "False"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.in.yaml
new file mode 100644
index 000000000..bc81721c4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.in.yaml
@@ -0,0 +1,43 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GatewayClass
+      name: envoy-gateway-class
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
new file mode 100644
index 000000000..c66e10852
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: EnvoyPatchPolicy is disabled in the EnvoyGateway configuration
+          reason: Disabled
+          status: "False"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.in.yaml
new file mode 100644
index 000000000..7a96a3833
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.in.yaml
@@ -0,0 +1,43 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
new file mode 100644
index 000000000..994a00695
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
@@ -0,0 +1,94 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: TargetRef.Group:gateway.networking.k8s.io TargetRef.Kind:Gateway,
+            only TargetRef.Group:gateway.networking.k8s.io and TargetRef.Kind:GatewayClass
+            is supported.
+          reason: Invalid
+          status: "False"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.in.yaml
new file mode 100644
index 000000000..d0f8d0530
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.in.yaml
@@ -0,0 +1,35 @@
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: MyGateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
new file mode 100644
index 000000000..84c1f20f3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
@@ -0,0 +1,84 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: TargetRef.Group:gateway.networking.k8s.io TargetRef.Kind:MyGateway,
+            only TargetRef.Group:gateway.networking.k8s.io and TargetRef.Kind:Gateway
+            is supported.
+          reason: Invalid
+          status: "False"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.in.yaml
new file mode 100644
index 000000000..f0cd4b988
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.in.yaml
@@ -0,0 +1,13 @@
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-unknown-gateway
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: unknown-gateway
+      namespace: envoy-gateway
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.out.yaml
new file mode 100644
index 000000000..fca40f1fe
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.out.yaml
@@ -0,0 +1,2 @@
+infraIR: {}
+xdsIR: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.in.yaml
new file mode 100644
index 000000000..303f4a233
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.in.yaml
@@ -0,0 +1,64 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GatewayClass
+      name: envoy-gateway-class
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-ignore-global-limit
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GatewayClass
+      name: envoy-gateway-class
+      namespace: envoy-gateway
+    # Higher priority
+    priority: -1
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/ignore_global_conn_limit"
+        value: "true"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
new file mode 100644
index 000000000..ea6ec6609
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
@@ -0,0 +1,115 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - jsonPatches:
+      - name: envoy-gateway-gateway-1-http
+        operation:
+          op: replace
+          path: /ignore_global_conn_limit
+          value: "true"
+        type: type.googleapis.com/envoy.config.listener.v3.Listener
+      name: edit-ignore-global-limit
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: EnvoyPatchPolicy has been accepted.
+          reason: Accepted
+          status: "True"
+          type: Accepted
+    - jsonPatches:
+      - name: envoy-gateway-gateway-1-http
+        operation:
+          op: replace
+          path: /per_connection_buffer_limit_bytes
+          value: "1024"
+        type: type.googleapis.com/envoy.config.listener.v3.Listener
+      name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: EnvoyPatchPolicy has been accepted.
+          reason: Accepted
+          status: "True"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.in.yaml
new file mode 100644
index 000000000..4924ee7ac
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.in.yaml
@@ -0,0 +1,56 @@
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-ignore-global-limit
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    # Higher priority
+    priority: -1
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/ignore_global_conn_limit"
+        value: "true"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.out.yaml
new file mode 100644
index 000000000..bcd4a2d07
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.out.yaml
@@ -0,0 +1,105 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - jsonPatches:
+      - name: envoy-gateway-gateway-1-http
+        operation:
+          op: replace
+          path: /ignore_global_conn_limit
+          value: "true"
+        type: type.googleapis.com/envoy.config.listener.v3.Listener
+      name: edit-ignore-global-limit
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: EnvoyPatchPolicy has been accepted.
+          reason: Accepted
+          status: "True"
+          type: Accepted
+    - jsonPatches:
+      - name: envoy-gateway-gateway-1-http
+        operation:
+          op: replace
+          path: /per_connection_buffer_limit_bytes
+          value: "1024"
+        type: type.googleapis.com/envoy.config.listener.v3.Listener
+      name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: EnvoyPatchPolicy has been accepted.
+          reason: Accepted
+          status: "True"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.in.yaml
new file mode 100644
index 000000000..507bc3162
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.in.yaml
@@ -0,0 +1,79 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+        - format:
+            type: JSON
+          sinks:
+          - type: File
+            file:
+              path: /dev/stdout
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
new file mode 100644
index 000000000..8fddd3e69
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
@@ -0,0 +1,137 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              settings:
+              - format:
+                  type: JSON
+                sinks:
+                - file:
+                    path: /dev/stdout
+                  type: File
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog: {}
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.in.yaml
new file mode 100644
index 000000000..f004ed31f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.in.yaml
@@ -0,0 +1,82 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+        - format:
+            type: JSON
+            json:
+              protocol: "%PROTOCOL%"
+              duration: "%DURATION%"
+          sinks:
+          - type: File
+            file:
+              path: /dev/stdout
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.out.yaml
new file mode 100644
index 000000000..73009d679
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.out.yaml
@@ -0,0 +1,145 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              settings:
+              - format:
+                  json:
+                    duration: '%DURATION%'
+                    protocol: '%PROTOCOL%'
+                  type: JSON
+                sinks:
+                - file:
+                    path: /dev/stdout
+                  type: File
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      json:
+      - json:
+          duration: '%DURATION%'
+          protocol: '%PROTOCOL%'
+        path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.in.yaml
new file mode 100644
index 000000000..6c0255abf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.in.yaml
@@ -0,0 +1,80 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+        - format:
+            type: Text
+            text: |
+              [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+          sinks:
+          - type: File
+          - type: OpenTelemetry
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
new file mode 100644
index 000000000..b88c60c05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
@@ -0,0 +1,138 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              settings:
+              - format:
+                  text: |
+                    [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+                  type: Text
+                sinks:
+                - type: File
+                - type: OpenTelemetry
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog: {}
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.in.yaml
new file mode 100644
index 000000000..d9e516557
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.in.yaml
@@ -0,0 +1,87 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+        - format:
+            type: Text
+            text: |
+              [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+          sinks:
+          - type: File
+            file:
+              path: /dev/stdout
+          - type: OpenTelemetry
+            openTelemetry:
+              host: otel-collector.monitoring.svc.cluster.local
+              port: 4317
+              resources:
+                k8s.cluster.name: "cluster-1"
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.out.yaml
new file mode 100644
index 000000000..353265e36
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.out.yaml
@@ -0,0 +1,156 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              settings:
+              - format:
+                  text: |
+                    [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+                  type: Text
+                sinks:
+                - file:
+                    path: /dev/stdout
+                  type: File
+                - openTelemetry:
+                    host: otel-collector.monitoring.svc.cluster.local
+                    port: 4317
+                    resources:
+                      k8s.cluster.name: cluster-1
+                  type: OpenTelemetry
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      openTelemetry:
+      - host: otel-collector.monitoring.svc.cluster.local
+        port: 4317
+        resources:
+          k8s.cluster.name: cluster-1
+        text: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+      text:
+      - format: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+        path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.in.yaml
new file mode 100644
index 000000000..24d8302c3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.in.yaml
@@ -0,0 +1,70 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.out.yaml
new file mode 100644
index 000000000..4a69b9bc6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.out.yaml
@@ -0,0 +1,130 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.in.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.in.yaml
new file mode 100644
index 000000000..9e910c6e9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: test
+extensionRefFilters:
+- apiVersion: foo.example.io
+  kind: Foo
+  metadata:
+    name: test
+    namespace: default
+  spec:
+    data: "stuff"
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.out.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.out.yaml
new file mode 100644
index 000000000..afd662552
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.out.yaml
@@ -0,0 +1,120 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: test
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Unable to translate APIVersion for Extension Filter: kind: Foo,
+          default/test'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'Unable to translate APIVersion for Extension Filter: kind: Foo,
+          default/test'
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.in.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.in.yaml
new file mode 100644
index 000000000..410d26bfe
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: example
+extensionRefFilters:
+- apiVersion: foo.example.io/v1alpha1
+  kind: Foo
+  metadata:
+    name: test
+    namespace: default
+  spec:
+    data: "stuff"
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.out.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.out.yaml
new file mode 100644
index 000000000..eead7496d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.out.yaml
@@ -0,0 +1,118 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: example
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Reference default/example not found for filter type: Foo'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'Reference default/example not found for filter type: Foo'
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.in.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.in.yaml
new file mode 100644
index 000000000..3021a18ae
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: foo.example.io
+          kind: Unsupported
+          name: test
+extensionRefFilters:
+- apiVersion: foo.example.io/v1alpha1
+  kind: Unsupported
+  metadata:
+    name: test
+    namespace: default
+  spec:
+    data: "stuff"
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.out.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.out.yaml
new file mode 100644
index 000000000..7de3b2833
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.out.yaml
@@ -0,0 +1,118 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - extensionRef:
+          group: foo.example.io
+          kind: Unsupported
+          name: test
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Invalid filter ExtensionRef: unknown kind foo.example.io/Unsupported'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.in.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.in.yaml
new file mode 100644
index 000000000..5bd190c9c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: test
+extensionRefFilters:
+- apiVersion: foo.example.io/v1alpha1
+  kind: Foo
+  metadata:
+    name: test
+    namespace: default
+  spec:
+    data: "stuff"
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.out.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.out.yaml
new file mode 100644
index 000000000..b9dc22fc1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.out.yaml
@@ -0,0 +1,147 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: test
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extensionRefs:
+        - object:
+            apiVersion: foo.example.io/v1alpha1
+            kind: Foo
+            metadata:
+              name: test
+              namespace: default
+            spec:
+              data: stuff
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.in.yaml
new file mode 100644
index 000000000..0dd2519dc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.in.yaml
@@ -0,0 +1,63 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: Same
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: envoy-gateway
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: envoy-gateway
+      name: service-1
+    spec:
+      clusterIP: 1.1.1.1
+      ports:
+        - name: http
+          port: 8080
+          protocol: TCP
+          targetPort: 8080
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-service-1
+      namespace: envoy-gateway
+      labels:
+        kubernetes.io/service-name: service-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "7.7.7.7"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
new file mode 100644
index 000000000..e7427151b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
@@ -0,0 +1,127 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.in.yaml
new file mode 100644
index 000000000..40c54eff3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.in.yaml
@@ -0,0 +1,32 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: Same
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
new file mode 100644
index 000000000..6a890eedf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
@@ -0,0 +1,107 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.in.yaml
new file mode 100644
index 000000000..fa6d64551
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.in.yaml
@@ -0,0 +1,76 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      infrastructure:
+        labels:
+          infra-label1: infra-val1
+          infra-label2: infra-val2
+        annotations:
+          infra-anno-key1: infra-anno-val1
+          infra-anno-key2: infra-anno-val2
+      listeners:
+        - name: https
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: Same
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+    status:
+      listeners:
+        - name: https
+          supportedKinds:
+            - group: gateway.networking.k8s.io
+              kind: HTTPRoute
+          attachedRoutes: 1
+          conditions:
+            - type: Programmed
+              status: "True"
+              reason: Programmed
+              message: Listener has been successfully translated
+        - name: http
+          supportedKinds:
+            - group: gateway.networking.k8s.io
+              kind: HTTPRoute
+          attachedRoutes: 1
+          conditions:
+            - type: Programmed
+              status: "True"
+              reason: Programmed
+              message: Listener has been successfully translated
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - name: gateway-1
+          namespace: default
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: default
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.out.yaml
new file mode 100644
index 000000000..5ea3b0e02
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.out.yaml
@@ -0,0 +1,150 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    infrastructure:
+      annotations:
+        infra-anno-key1: infra-anno-val1
+        infra-anno-key2: infra-anno-val2
+      labels:
+        infra-label1: infra-val1
+        infra-label2: infra-val2
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: https
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/https
+        ports:
+        - containerPort: 10443
+          name: https
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        annotations:
+          infra-anno-key1: infra-anno-val1
+          infra-anno-key2: infra-anno-val2
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+          infra-label1: infra-val1
+          infra-label2: infra-val2
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/https
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: default/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.in.yaml
new file mode 100644
index 000000000..e4194dd15
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.in.yaml
@@ -0,0 +1,19 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 80
+      addresses:
+        - type: IPAddress
+          value: 1.2.3.4
+        - type: IPAddress
+          value: 5.6.7.8
+        - type: Hostname
+          value: foo.bar
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.out.yaml
new file mode 100644
index 000000000..3c0b792d5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.out.yaml
@@ -0,0 +1,67 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    addresses:
+    - type: IPAddress
+      value: 1.2.3.4
+    - type: IPAddress
+      value: 5.6.7.8
+    - type: Hostname
+      value: foo.bar
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      addresses:
+      - 1.2.3.4
+      - 5.6.7.8
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10080
+          name: tcp
+          protocol: TCP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.in.yaml
new file mode 100644
index 000000000..7c71b1eaa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.in.yaml
@@ -0,0 +1,38 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: Selector
+              selector:
+                matchExpressions:
+                  - key: foo
+                    operator: Exists
+                    values:
+                      - bar
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
new file mode 100644
index 000000000..9ba997089
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchExpressions:
+            - key: foo
+              operator: Exists
+              values:
+              - bar
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: 'The allowedRoutes.namespaces.selector could not be parsed: values:
+          Invalid value: []string{"bar"}: values set must be empty for exists and
+          does not exist.'
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.in.yaml
new file mode 100644
index 000000000..e31eab269
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+            kinds:
+              - group: foo.io
+                kind: HTTPRoute
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
new file mode 100644
index 000000000..6869b02ad
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
@@ -0,0 +1,83 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        kinds:
+        - group: foo.io
+          kind: HTTPRoute
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Group is not supported, group must be gateway.networking.k8s.io
+        reason: InvalidRouteKinds
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: http
+      supportedKinds: []
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.in.yaml
new file mode 100644
index 000000000..3c1d72a73
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.in.yaml
@@ -0,0 +1,37 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+            kinds:
+              - group: gateway.networking.k8s.io
+                kind: FooRoute
+              - group:
+                kind: HTTPRoute
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
new file mode 100644
index 000000000..235dcf33c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
@@ -0,0 +1,85 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        kinds:
+        - group: gateway.networking.k8s.io
+          kind: FooRoute
+        - kind: HTTPRoute
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: FooRoute is not supported, kind must be one of [HTTPRoute]
+        reason: InvalidRouteKinds
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: http
+      supportedKinds:
+      - kind: HTTPRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.in.yaml
new file mode 100644
index 000000000..dd3061ecf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+            kinds:
+              - group: gateway.networking.k8s.io
+                kind: FooRoute
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
new file mode 100644
index 000000000..14f241429
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
@@ -0,0 +1,83 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        kinds:
+        - group: gateway.networking.k8s.io
+          kind: FooRoute
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: FooRoute is not supported, kind must be one of [HTTPRoute GRPCRoute]
+        reason: InvalidRouteKinds
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: http
+      supportedKinds: []
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.in.yaml
new file mode 100644
index 000000000..ee989f7fa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          hostname: foo.com
+          protocol: TLS
+          port: 80
+          tls:
+            mode: Passthrough
+          allowedRoutes:
+            namespaces:
+              from: All
+            kinds:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
new file mode 100644
index 000000000..80ee8a1cf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
@@ -0,0 +1,83 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        kinds:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls
+      port: 80
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: HTTPRoute is not supported, kind must be one of [TLSRoute]
+        reason: InvalidRouteKinds
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds: []
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.in.yaml
new file mode 100644
index 000000000..be3ac0e7b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.in.yaml
@@ -0,0 +1,66 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-ecdsa-1
+              - name: tls-secret-ecdsa-2
+              - name: tls-secret-1
+
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-ecdsa-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lVRm1sOExCRzBvL1FLNFErWjdrODI0c0MyaUZ3d0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJMYVl2cUt1VlZveERvNTJlV3p2WUI1anc3RU1GODZybXlvaTVadWF5emRNdnBnNHpCcjgKUktCak5zK1QxakI4T0t1Y1MvN1JVRHgwcHorOTc2ek0zaU9qVXpCUk1CMEdBMVVkRGdRV0JCVE82K2NnMFIwZAp3dHJ6SlFQRzZnNzZoQkJVelRBZkJnTlZIU01FR0RBV2dCVE82K2NnMFIwZHd0cnpKUVBHNmc3NmhCQlV6VEFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFDMlhwUFFnUXpXYWUzYjVwWnQKR2N1TWZESjBjME9QS2NuZWdrWFoyQzRCM2dJZ1Uvc1Jrd0lwTFFOUlYrRWFZdzRQNVQ1Z1BFNlkrVnBtQzk4aApvVmpaL3pRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+      tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxEbnZNM1RKM3NHYm9EeTF4T3dqSVppVFNWeWZXVWF5YVExcWdrdUdacEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSDVWdHJjenJQS091alV5RTMyaDU2UnVrdHUzSVhTVnJJMkNibXh5UUpqcEY3di9rNVNqTQpSVXZjUnBCdmpnQWROaGhUNGNUMXV4YW1TMFlmQ2JXMVhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-ecdsa-2
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ2VENDQVVTZ0F3SUJBZ0lVU2l2SkdURHdva1M3aGVZLzJjc1JzejR2SkIwd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCMk1CQUdCeXFHU000OUFnRUdCU3VCCkJBQWlBMklBQkZ2cnZSZWJhYVd1UzZNQUVJZDZ3WmZPS3Z1Q1R5VU1PbFpKcUZDRjlUa3pNWWw4Q2lvZnluT3QKQ3JzMHZ2YTlrZC9QMkpNR0JKcWdZZXZid290clJpMTJxTG5IMDQvam9HSWpqVE9LbzNJb2ZyK0ZrOHdMdkFlMwpPMVpLdFI5c3pxTlRNRkV3SFFZRFZSME9CQllFRklLczFRRm5vRHQ5K3Fva1I0T0RXYk16MWYrUE1COEdBMVVkCkl3UVlNQmFBRklLczFRRm5vRHQ5K3Fva1I0T0RXYk16MWYrUE1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0NnWUkKS29aSXpqMEVBd0lEWndBd1pBSXdIMzF0SHlmVVAwNFhIcGJXR2UxWjFJYUJaQndJdGg1NURVNGhqZlB1OG0rSgpXdjdiVzh6VFNnd0xpcW9yZmN1bkFqQTBnaE5KQkExWDJYdElLRG1sM3M3L1Z4OEZKY1MwNHZwQ2hoK2xBYkxTCnZlYWEyOFIzVExFWTNVK1FUWEkvd0lrPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.key: YmFyCg==
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
new file mode 100644
index 000000000..1c7ce3aa5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
@@ -0,0 +1,98 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-ecdsa-1
+        - group: null
+          kind: null
+          name: tls-secret-ecdsa-2
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Secret envoy-gateway/tls-secret-ecdsa-2 public key algorithm must
+          be unique, matched certificate FQDN [foo.bar.com] has a conflicting algorithm
+          [ECDSA].
+        reason: InvalidCertificateRef
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.in.yaml
new file mode 100644
index 000000000..e0f69d01a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.in.yaml
@@ -0,0 +1,47 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          hostname: foo.com
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Passthrough
+            certificateRefs:
+              - name: tls-secret-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: Zm9vCg==
+      tls.key: YmFyCg==
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
new file mode 100644
index 000000000..d4cf64070
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
@@ -0,0 +1,91 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: TLS Passthrough mode is not supported, TLS mode must be Terminate.
+        reason: UnsupportedTLSMode
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.in.yaml
new file mode 100644
index 000000000..54feff746
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.in.yaml
@@ -0,0 +1,44 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: Zm9vCg==
+      tls.key: YmFyCg==
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
new file mode 100644
index 000000000..a6291fdcd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
@@ -0,0 +1,86 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must have at least 1 TLS certificate ref
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.in.yaml
new file mode 100644
index 000000000..0c3a5060b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.in.yaml
@@ -0,0 +1,47 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          hostname: example.com
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
new file mode 100644
index 000000000..ec5a8b858
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
@@ -0,0 +1,93 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: example.com
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Secret envoy-gateway/tls-secret-1 must contain valid tls.crt and
+          tls.key, hostname example.com does not match Common Name or DNS Names in
+          the certificate tls.crt.
+        reason: InvalidCertificateRef
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.in.yaml
new file mode 100644
index 000000000..95bffc38b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.in.yaml
@@ -0,0 +1,36 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
new file mode 100644
index 000000000..358feaa32
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
@@ -0,0 +1,90 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Secret envoy-gateway/tls-secret-1 does not exist.
+        reason: InvalidCertificateRef
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.in.yaml
new file mode 100644
index 000000000..caab5079f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.in.yaml
@@ -0,0 +1,47 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+                namespace: default
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: default
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: Zm9vCg==
+      tls.key: YmFyCg==
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
new file mode 100644
index 000000000..0cd7c47e5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+          namespace: default
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Certificate ref to secret default/tls-secret-1 not permitted by any
+          ReferenceGrant.
+        reason: RefNotPermitted
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.in.yaml
new file mode 100644
index 000000000..75e6051a2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.in.yaml
@@ -0,0 +1,45 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.key: YmFyCg==
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
new file mode 100644
index 000000000..8bfcf8097
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
@@ -0,0 +1,90 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Secret envoy-gateway/tls-secret-1 must contain tls.crt and tls.key.
+        reason: InvalidCertificateRef
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.in.yaml
new file mode 100644
index 000000000..f24ab41fe
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.in.yaml
@@ -0,0 +1,32 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: Selector
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
new file mode 100644
index 000000000..86b2c8cb2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
@@ -0,0 +1,85 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Selector
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: The allowedRoutes.namespaces.selector field must be specified when
+          allowedRoutes.namespaces.from is set to "Selector".
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.in.yaml
new file mode 100644
index 000000000..f027c23e6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.in.yaml
@@ -0,0 +1,16 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          hostname: foo.com
+          protocol: TCP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
new file mode 100644
index 000000000..4e6bc7a18
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must not have hostname set when protocol is TCP.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.in.yaml
new file mode 100644
index 000000000..1cc29af9d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8081
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
new file mode 100644
index 000000000..62e423b7f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 162
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10162
+          name: tcp
+          protocol: TCP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8081
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: TCP Port 8081 not found on service default/service-1
+        reason: PortNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.in.yaml
new file mode 100644
index 000000000..f0291a531
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+              weight: 50
+            - name: service-2
+              port: 8080
+              weight: 50
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
new file mode 100644
index 000000000..df0712fb8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
@@ -0,0 +1,96 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10080
+          name: tcp
+          protocol: TCP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+        weight: 50
+      - name: service-2
+        port: 8080
+        weight: 50
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: One and only one backend is supported
+        reason: InvalidBackend
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.in.yaml
new file mode 100644
index 000000000..179769001
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.in.yaml
@@ -0,0 +1,34 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+              weight: 50
+        - backendRefs:
+            - name: service-2
+              port: 8080
+              weight: 50
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
new file mode 100644
index 000000000..5f95991a2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
@@ -0,0 +1,97 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10080
+          name: tcp
+          protocol: TCP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+        weight: 50
+    - backendRefs:
+      - name: service-2
+        port: 8080
+        weight: 50
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: One and only one rule is supported
+        reason: InvalidRule
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.in.yaml
new file mode 100644
index 000000000..2882a44c1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.in.yaml
@@ -0,0 +1,61 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+                namespace: default
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: default
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: default
+      name: referencegrant-1
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+      to:
+        - group: ""
+          kind: Secret
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
new file mode 100644
index 000000000..26dedcf51
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -0,0 +1,139 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+          namespace: default
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10443
+          name: tls
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: default/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.in.yaml
new file mode 100644
index 000000000..09c8d2137
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.in.yaml
@@ -0,0 +1,70 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls-passthrough
+          protocol: TLS
+          port: 90
+          hostname: foo.bar.com
+          tls:
+            mode: Passthrough
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tls-terminate
+          protocol: HTTPS
+          port: 443
+          hostname: foo.bar.com
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+          allowedRoutes:
+            namespaces:
+              from: All
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8080
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
new file mode 100644
index 000000000..1cfa15a3c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
@@ -0,0 +1,225 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.bar.com
+      name: tls-passthrough
+      port: 90
+      protocol: TLS
+      tls:
+        mode: Passthrough
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.bar.com
+      name: tls-terminate
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls-passthrough
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls-terminate
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls-passthrough
+        ports:
+        - containerPort: 10090
+          name: tls-passthrough
+          protocol: TLS
+          servicePort: 90
+      - address: null
+        name: envoy-gateway/gateway-1/tls-terminate
+        ports:
+        - containerPort: 10443
+          name: tls-terminate
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls-terminate
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo_bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: envoy-gateway/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls-passthrough/tlsroute-1
+      port: 10090
+      tls:
+        passthrough:
+          snis:
+          - foo.bar.com
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.in.yaml
new file mode 100644
index 000000000..f8e9d3859
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.in.yaml
@@ -0,0 +1,16 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          hostname: foo.com
+          protocol: UDP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
new file mode 100644
index 000000000..cf80aeec7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must not have hostname set when protocol is UDP.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.in.yaml
new file mode 100644
index 000000000..440e8c9fd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
new file mode 100644
index 000000000..71c654741
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 162
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10162
+          name: udp
+          protocol: UDP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: UDP Port 8080 not found on service default/service-1
+        reason: PortNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.in.yaml
new file mode 100644
index 000000000..6dfe97fba
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          protocol: UDP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+              weight: 50
+            - name: service-2
+              port: 8080
+              weight: 50
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
new file mode 100644
index 000000000..7ee99d034
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
@@ -0,0 +1,96 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10080
+          name: udp
+          protocol: UDP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+        weight: 50
+      - name: service-2
+        port: 8080
+        weight: 50
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: One and only one backend is supported
+        reason: InvalidBackend
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.in.yaml
new file mode 100644
index 000000000..ecb2d33e0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.in.yaml
@@ -0,0 +1,34 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          protocol: UDP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+              weight: 50
+        - backendRefs:
+            - name: service-2
+              port: 8080
+              weight: 50
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
new file mode 100644
index 000000000..619a17b0e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
@@ -0,0 +1,97 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10080
+          name: udp
+          protocol: UDP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+        weight: 50
+    - backendRefs:
+      - name: service-2
+        port: 8080
+        weight: 50
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: One and only one rule is supported
+        reason: InvalidRule
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.in.yaml
new file mode 100644
index 000000000..bba952493
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-2
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
new file mode 100644
index 000000000..d5205682c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
@@ -0,0 +1,60 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10080
+          name: tcp
+          protocol: TCP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.in.yaml
new file mode 100644
index 000000000..2f7fa01b5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          protocol: UDP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-2
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
new file mode 100644
index 000000000..2c5574c69
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
@@ -0,0 +1,60 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10080
+          name: udp
+          protocol: UDP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.in.yaml
new file mode 100644
index 000000000..12598d5c2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.in.yaml
@@ -0,0 +1,32 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: unsupported
+          protocol: GRPC
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
new file mode 100644
index 000000000..bc6bca89e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
@@ -0,0 +1,85 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: unsupported
+      port: 80
+      protocol: GRPC
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Protocol GRPC is unsupported, must be HTTP, HTTPS, TCP or UDP.
+        reason: UnsupportedProtocol
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: unsupported
+      supportedKinds: null
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.in.yaml
new file mode 100644
index 000000000..827436641
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-ecdsa-1
+              - name: tls-secret-ecdsa-2
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-ecdsa-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lVRm1sOExCRzBvL1FLNFErWjdrODI0c0MyaUZ3d0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJMYVl2cUt1VlZveERvNTJlV3p2WUI1anc3RU1GODZybXlvaTVadWF5emRNdnBnNHpCcjgKUktCak5zK1QxakI4T0t1Y1MvN1JVRHgwcHorOTc2ek0zaU9qVXpCUk1CMEdBMVVkRGdRV0JCVE82K2NnMFIwZAp3dHJ6SlFQRzZnNzZoQkJVelRBZkJnTlZIU01FR0RBV2dCVE82K2NnMFIwZHd0cnpKUVBHNmc3NmhCQlV6VEFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFDMlhwUFFnUXpXYWUzYjVwWnQKR2N1TWZESjBjME9QS2NuZWdrWFoyQzRCM2dJZ1Uvc1Jrd0lwTFFOUlYrRWFZdzRQNVQ1Z1BFNlkrVnBtQzk4aApvVmpaL3pRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+      tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxEbnZNM1RKM3NHYm9EeTF4T3dqSVppVFNWeWZXVWF5YVExcWdrdUdacEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSDVWdHJjenJQS091alV5RTMyaDU2UnVrdHUzSVhTVnJJMkNibXh5UUpqcEY3di9rNVNqTQpSVXZjUnBCdmpnQWROaGhUNGNUMXV4YW1TMFlmQ2JXMVhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-ecdsa-2
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZakNCNlFJSkFNcDhYTGNsWGJ2NU1Bb0dDQ3FHU000OUJBTUNNQnN4R1RBWEJnTlZCQU1NRUhSbGMzUXUKWlhoaGJYQnNaUzVqYjIwd0hoY05Nak13TlRJMU1UUXhNRFF5V2hjTk1qUXdOVEkwTVRReE1EUXlXakFiTVJrdwpGd1lEVlFRRERCQjBaWE4wTG1WNFlXMXdiR1V1WTI5dE1IWXdFQVlIS29aSXpqMENBUVlGSzRFRUFDSURZZ0FFCmVNdEhDM2hJZXEyUXNka3RTaS9aTlIvTUtOYXZTbTNITm43dEdvZ2ZxYXFuOEFTZ0hJYTd5VVUrK1Bzb0RENmsKZisrQ2U3dXNkMG1RTzFTbmRZSVdqMlFMaUl6ME5aSDhCL1FyNGk3SjBJS3dzUWxVbnVuWnF2NUtZOVRMUWEwbgpNQW9HQ0NxR1NNNDlCQU1DQTJnQU1HVUNNUUNHVGpQa2hqZE1KcWUrVjFGRWpteUk2andEV0FDalhucFRuaXhVCnM2dUNKZjVNNUw1TmpGYmkydGplMGlES0UxVUNNQXdxSjZmOUs2bUhUd2JxVGkzTVNFMmQxODl6aUcyWVZCaUQKYmVXcHc0UjF5ZTdHRFJvVm9veG9ob2lERjdsNm13PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+      tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1JR2tBZ0VCQkRDUUE5VWo0SkR5c0Q0MlJIMGI2cjU5NTlXTmlXU2ZKZlMxK2RvTjk0TzZCUGdaQUJiUTI4eTIKUTZsM3pZdklLeFNnQndZRks0RUVBQ0toWkFOaUFBUjR5MGNMZUVoNnJaQ3gyUzFLTDlrMUg4d28xcTlLYmNjMgpmdTBhaUIrcHFxZndCS0FjaHJ2SlJUNzQreWdNUHFSLzc0Sjd1NngzU1pBN1ZLZDFnaGFQWkF1SWpQUTFrZndICjlDdmlMc25RZ3JDeENWU2U2ZG1xL2twajFNdEJyU2M9Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
new file mode 100644
index 000000000..c5972d5f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
@@ -0,0 +1,144 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-ecdsa-1
+        - group: null
+          kind: null
+          name: tls-secret-ecdsa-2
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10443
+          name: tls
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: envoy-gateway/tls-secret-ecdsa-1
+          privateKey: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxEbnZNM1RKM3NHYm9EeTF4T3dqSVppVFNWeWZXVWF5YVExcWdrdUdacEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSDVWdHJjenJQS091alV5RTMyaDU2UnVrdHUzSVhTVnJJMkNibXh5UUpqcEY3di9rNVNqTQpSVXZjUnBCdmpnQWROaGhUNGNUMXV4YW1TMFlmQ2JXMVhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lVRm1sOExCRzBvL1FLNFErWjdrODI0c0MyaUZ3d0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJMYVl2cUt1VlZveERvNTJlV3p2WUI1anc3RU1GODZybXlvaTVadWF5emRNdnBnNHpCcjgKUktCak5zK1QxakI4T0t1Y1MvN1JVRHgwcHorOTc2ek0zaU9qVXpCUk1CMEdBMVVkRGdRV0JCVE82K2NnMFIwZAp3dHJ6SlFQRzZnNzZoQkJVelRBZkJnTlZIU01FR0RBV2dCVE82K2NnMFIwZHd0cnpKUVBHNmc3NmhCQlV6VEFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFDMlhwUFFnUXpXYWUzYjVwWnQKR2N1TWZESjBjME9QS2NuZWdrWFoyQzRCM2dJZ1Uvc1Jrd0lwTFFOUlYrRWFZdzRQNVQ1Z1BFNlkrVnBtQzk4aApvVmpaL3pRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+        - name: envoy-gateway/tls-secret-ecdsa-2
+          privateKey: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1JR2tBZ0VCQkRDUUE5VWo0SkR5c0Q0MlJIMGI2cjU5NTlXTmlXU2ZKZlMxK2RvTjk0TzZCUGdaQUJiUTI4eTIKUTZsM3pZdklLeFNnQndZRks0RUVBQ0toWkFOaUFBUjR5MGNMZUVoNnJaQ3gyUzFLTDlrMUg4d28xcTlLYmNjMgpmdTBhaUIrcHFxZndCS0FjaHJ2SlJUNzQreWdNUHFSLzc0Sjd1NngzU1pBN1ZLZDFnaGFQWkF1SWpQUTFrZndICjlDdmlMc25RZ3JDeENWU2U2ZG1xL2twajFNdEJyU2M9Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZakNCNlFJSkFNcDhYTGNsWGJ2NU1Bb0dDQ3FHU000OUJBTUNNQnN4R1RBWEJnTlZCQU1NRUhSbGMzUXUKWlhoaGJYQnNaUzVqYjIwd0hoY05Nak13TlRJMU1UUXhNRFF5V2hjTk1qUXdOVEkwTVRReE1EUXlXakFiTVJrdwpGd1lEVlFRRERCQjBaWE4wTG1WNFlXMXdiR1V1WTI5dE1IWXdFQVlIS29aSXpqMENBUVlGSzRFRUFDSURZZ0FFCmVNdEhDM2hJZXEyUXNka3RTaS9aTlIvTUtOYXZTbTNITm43dEdvZ2ZxYXFuOEFTZ0hJYTd5VVUrK1Bzb0RENmsKZisrQ2U3dXNkMG1RTzFTbmRZSVdqMlFMaUl6ME5aSDhCL1FyNGk3SjBJS3dzUWxVbnVuWnF2NUtZOVRMUWEwbgpNQW9HQ0NxR1NNNDlCQU1DQTJnQU1HVUNNUUNHVGpQa2hqZE1KcWUrVjFGRWpteUk2andEV0FDalhucFRuaXhVCnM2dUNKZjVNNUw1TmpGYmkydGplMGlES0UxVUNNQXdxSjZmOUs2bUhUd2JxVGkzTVNFMmQxODl6aUcyWVZCaUQKYmVXcHc0UjF5ZTdHRFJvVm9veG9ob2lERjdsNm13PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.in.yaml
new file mode 100644
index 000000000..58abae412
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+              - name: tls-secret-ecdsa-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-ecdsa-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lVRm1sOExCRzBvL1FLNFErWjdrODI0c0MyaUZ3d0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJMYVl2cUt1VlZveERvNTJlV3p2WUI1anc3RU1GODZybXlvaTVadWF5emRNdnBnNHpCcjgKUktCak5zK1QxakI4T0t1Y1MvN1JVRHgwcHorOTc2ek0zaU9qVXpCUk1CMEdBMVVkRGdRV0JCVE82K2NnMFIwZAp3dHJ6SlFQRzZnNzZoQkJVelRBZkJnTlZIU01FR0RBV2dCVE82K2NnMFIwZHd0cnpKUVBHNmc3NmhCQlV6VEFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFDMlhwUFFnUXpXYWUzYjVwWnQKR2N1TWZESjBjME9QS2NuZWdrWFoyQzRCM2dJZ1Uvc1Jrd0lwTFFOUlYrRWFZdzRQNVQ1Z1BFNlkrVnBtQzk4aApvVmpaL3pRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+      tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxEbnZNM1RKM3NHYm9EeTF4T3dqSVppVFNWeWZXVWF5YVExcWdrdUdacEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSDVWdHJjenJQS091alV5RTMyaDU2UnVrdHUzSVhTVnJJMkNibXh5UUpqcEY3di9rNVNqTQpSVXZjUnBCdmpnQWROaGhUNGNUMXV4YW1TMFlmQ2JXMVhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
new file mode 100644
index 000000000..9b1b70520
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
@@ -0,0 +1,144 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        - group: null
+          kind: null
+          name: tls-secret-ecdsa-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10443
+          name: tls
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: envoy-gateway/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+        - name: envoy-gateway/tls-secret-ecdsa-1
+          privateKey: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxEbnZNM1RKM3NHYm9EeTF4T3dqSVppVFNWeWZXVWF5YVExcWdrdUdacEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSDVWdHJjenJQS091alV5RTMyaDU2UnVrdHUzSVhTVnJJMkNibXh5UUpqcEY3di9rNVNqTQpSVXZjUnBCdmpnQWROaGhUNGNUMXV4YW1TMFlmQ2JXMVhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lVRm1sOExCRzBvL1FLNFErWjdrODI0c0MyaUZ3d0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJMYVl2cUt1VlZveERvNTJlV3p2WUI1anc3RU1GODZybXlvaTVadWF5emRNdnBnNHpCcjgKUktCak5zK1QxakI4T0t1Y1MvN1JVRHgwcHorOTc2ek0zaU9qVXpCUk1CMEdBMVVkRGdRV0JCVE82K2NnMFIwZAp3dHJ6SlFQRzZnNzZoQkJVelRBZkJnTlZIU01FR0RBV2dCVE82K2NnMFIwZHd0cnpKUVBHNmc3NmhCQlV6VEFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFDMlhwUFFnUXpXYWUzYjVwWnQKR2N1TWZESjBjME9QS2NuZWdrWFoyQzRCM2dJZ1Uvc1Jrd0lwTFFOUlYrRWFZdzRQNVQ1Z1BFNlkrVnBtQzk4aApvVmpaL3pRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.in.yaml
new file mode 100644
index 000000000..6949425c3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.in.yaml
@@ -0,0 +1,46 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
new file mode 100644
index 000000000..fbf4cd0da
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
@@ -0,0 +1,138 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10443
+          name: tls
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: envoy-gateway/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.in.yaml
new file mode 100644
index 000000000..da4aeea8d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.in.yaml
@@ -0,0 +1,55 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: Same
+    status:
+      listeners:
+        - name: http
+          supportedKinds:
+            - group: gateway.networking.k8s.io
+              kind: HTTPRoute
+          attachedRoutes: 1
+          conditions:
+            - type: Programmed
+              status: "True"
+              reason: Programmed
+              message: Listener has been successfully translated
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+    status:
+      parents:
+        - parentRef:
+            namespace: default
+            name: gateway-1
+          controllerName: apk.wso2.com/gatewayclass-controller
+          conditions:
+            - type: Accepted
+              status: "True"
+              reason: Accepted
+              message: Route is accepted
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.out.yaml
new file mode 100644
index 000000000..e6c5dec57
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.out.yaml
@@ -0,0 +1,127 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.in.yaml
new file mode 100644
index 000000000..27fc4622a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8163
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
new file mode 100644
index 000000000..5f12b5c6c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
@@ -0,0 +1,137 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 162
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10162
+          name: tcp
+          protocol: TCP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Multiple routes on the same TCP listener
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp/tcproute-1
+      port: 10162
+      tls: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.in.yaml
new file mode 100644
index 000000000..0d8be2905
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8162
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
new file mode 100644
index 000000000..90932e5fa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
@@ -0,0 +1,136 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 162
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10162
+          name: udp
+          protocol: UDP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Multiple routes on the same UDP listener
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    udp:
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp/udproute-1
+      port: 10162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.in.yaml
new file mode 100644
index 000000000..f40fbbe83
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.in.yaml
@@ -0,0 +1,69 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: https
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: Same
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+    status:
+      listeners:
+        - name: https
+          supportedKinds:
+            - group: gateway.networking.k8s.io
+              kind: HTTPRoute
+          attachedRoutes: 1
+          conditions:
+            - type: Programmed
+              status: "True"
+              reason: Programmed
+              message: Listener has been successfully translated
+        - name: http
+          supportedKinds:
+            - group: gateway.networking.k8s.io
+              kind: HTTPRoute
+          attachedRoutes: 1
+          conditions:
+            - type: Programmed
+              status: "True"
+              reason: Programmed
+              message: Listener has been successfully translated
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - name: gateway-1
+          namespace: default
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: default
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.out.yaml
new file mode 100644
index 000000000..10ae0979e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.out.yaml
@@ -0,0 +1,138 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: https
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/https
+        ports:
+        - containerPort: 10443
+          name: https
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/https
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: default/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.in.yaml
new file mode 100644
index 000000000..049c79741
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp1
+          protocol: TCP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tcp2
+          protocol: TLS
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
new file mode 100644
index 000000000..ca1cdd348
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
@@ -0,0 +1,135 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp1
+      port: 162
+      protocol: TCP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp2
+      port: 162
+      protocol: TLS
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Only one TCP/TLS listener is allowed in a given port
+        reason: ProtocolConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener must have TLS set when protocol is TLS.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp1
+        ports:
+        - containerPort: 10162
+          name: tcp1
+          protocol: TCP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp1/tcproute-1
+      port: 10162
+      tls: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.in.yaml
new file mode 100644
index 000000000..50601282f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp1
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: udp2
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
new file mode 100644
index 000000000..fbb6bdc8c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
@@ -0,0 +1,132 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp1
+      port: 162
+      protocol: UDP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp2
+      port: 162
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Only one UDP listener is allowed in a given port
+        reason: ProtocolConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp1
+        ports:
+        - containerPort: 10162
+          name: udp1
+          protocol: UDP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    udp:
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp1/udproute-1
+      port: 10162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.in.yaml
new file mode 100644
index 000000000..90fe76523
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-1
+      protocol: HTTP
+      port: 80
+      hostname: foo.com
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: tls-1
+      protocol: TLS
+      tls:
+        mode: Passthrough
+      port: 80
+      hostname: foo.com
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    namespace: default
+    name: tlsroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
new file mode 100644
index 000000000..20716b62a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
@@ -0,0 +1,152 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls-1
+      port: 80
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.in.yaml
new file mode 100644
index 000000000..d0cadfda0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-1
+      protocol: HTTP
+      port: 80
+      hostname: foo.com
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: http-2
+      protocol: HTTP
+      port: 81
+      hostname: bar.com
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/test"
+      backendRefs:
+      - name: service-2
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
new file mode 100644
index 000000000..51077a7f7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
@@ -0,0 +1,266 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 81
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /test
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-1
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-1/http-2
+        ports:
+        - containerPort: 10081
+          name: http-2
+          protocol: HTTP
+          servicePort: 81
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /test
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10081
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /test
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.in.yaml
new file mode 100644
index 000000000..69b93f3b1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.in.yaml
@@ -0,0 +1,40 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-1
+      protocol: HTTP
+      port: 80
+      hostname: foo.com
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: http-2
+      protocol: HTTP
+      port: 80
+      hostname: foo.com
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
new file mode 100644
index 000000000..c620ac15e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
@@ -0,0 +1,120 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-2
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.in.yaml
new file mode 100644
index 000000000..37c0a342f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.in.yaml
@@ -0,0 +1,40 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 80
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-2
+          protocol: HTTPS
+          port: 80
+          hostname: bar.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
new file mode 100644
index 000000000..0052f3f6f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
@@ -0,0 +1,120 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 80
+      protocol: HTTPS
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a compatible protocol
+        reason: ProtocolConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a compatible protocol
+        reason: ProtocolConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener must have TLS set when protocol is HTTPS.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.in.yaml
new file mode 100644
index 000000000..34bd7a43e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.in.yaml
@@ -0,0 +1,53 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          hostname: "*"
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tcp
+          protocol: TCP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
new file mode 100644
index 000000000..19401c821
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
@@ -0,0 +1,208 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*'
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10080
+          name: tcp
+          protocol: TCP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp/tcproute-1
+      port: 10080
+      tls: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.in.yaml
new file mode 100644
index 000000000..d4ef5be9e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.in.yaml
@@ -0,0 +1,53 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          hostname: "*"
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: udp
+          protocol: UDP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
new file mode 100644
index 000000000..9d48e0cdd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
@@ -0,0 +1,207 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*'
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10080
+          name: udp
+          protocol: UDP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    udp:
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp/udproute-1
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.in.yaml
new file mode 100644
index 000000000..a4bb69bb7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp1
+          protocol: TCP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tcp2
+          protocol: TCP
+          port: 163
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: tcp1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8163
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: tcp2
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
new file mode 100644
index 000000000..577112861
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
@@ -0,0 +1,188 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp1
+      port: 162
+      protocol: TCP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp2
+      port: 163
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp1
+        ports:
+        - containerPort: 10162
+          name: tcp1
+          protocol: TCP
+          servicePort: 162
+      - address: null
+        name: envoy-gateway/gateway-1/tcp2
+        ports:
+        - containerPort: 10163
+          name: tcp2
+          protocol: TCP
+          servicePort: 163
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: tcp1
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: tcp1
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: tcp2
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: tcp2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp1/tcproute-1
+      port: 10162
+      tls: {}
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-2/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp2/tcproute-2
+      port: 10163
+      tls: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.in.yaml
new file mode 100644
index 000000000..1ba01ba6c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp1
+          protocol: TCP
+          port: 161
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tcp2
+          protocol: TCP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8163
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
new file mode 100644
index 000000000..9c3c7ba54
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
@@ -0,0 +1,184 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp1
+      port: 161
+      protocol: TCP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp2
+      port: 162
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp1
+        ports:
+        - containerPort: 10161
+          name: tcp1
+          protocol: TCP
+          servicePort: 161
+      - address: null
+        name: envoy-gateway/gateway-1/tcp2
+        ports:
+        - containerPort: 10162
+          name: tcp2
+          protocol: TCP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Multiple routes on the same TCP listener
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp1/tcproute-1
+      port: 10161
+      tls: {}
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp2/tcproute-1
+      port: 10162
+      tls: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.in.yaml
new file mode 100644
index 000000000..dc3a42ab7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp1
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: udp2
+          protocol: UDP
+          port: 163
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: udp1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8162
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: udp2
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
new file mode 100644
index 000000000..b0e951037
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
@@ -0,0 +1,186 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp1
+      port: 162
+      protocol: UDP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp2
+      port: 163
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp1
+        ports:
+        - containerPort: 10162
+          name: udp1
+          protocol: UDP
+          servicePort: 162
+      - address: null
+        name: envoy-gateway/gateway-1/udp2
+        ports:
+        - containerPort: 10163
+          name: udp2
+          protocol: UDP
+          servicePort: 163
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: udp1
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: udp1
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: udp2
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: udp2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    udp:
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp1/udproute-1
+      port: 10162
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-2/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp2/udproute-2
+      port: 10163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.in.yaml
new file mode 100644
index 000000000..2638f0f19
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp1
+          protocol: UDP
+          port: 161
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: udp2
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8162
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
new file mode 100644
index 000000000..999c2e716
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
@@ -0,0 +1,182 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp1
+      port: 161
+      protocol: UDP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp2
+      port: 162
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp1
+        ports:
+        - containerPort: 10161
+          name: udp1
+          protocol: UDP
+          servicePort: 161
+      - address: null
+        name: envoy-gateway/gateway-1/udp2
+        ports:
+        - containerPort: 10162
+          name: udp2
+          protocol: UDP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Multiple routes on the same UDP listener
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    udp:
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp1/udproute-1
+      port: 10161
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp2/udproute-1
+      port: 10162
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.in.yaml
new file mode 100644
index 000000000..69bfd7a1f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.in.yaml
@@ -0,0 +1,31 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - method:
+          service: com.ExampleExact
+          type: Exact
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.out.yaml
new file mode 100644
index 000000000..df188f66a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.out.yaml
@@ -0,0 +1,120 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - matches:
+      - method:
+          service: com.ExampleExact
+          type: Exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /com.ExampleExact
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.in.yaml
new file mode 100644
index 000000000..ae2baa8dc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - headers:
+        - type: Exact
+          name: magic
+          value: foo
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.out.yaml
new file mode 100644
index 000000000..33d91c16f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.out.yaml
@@ -0,0 +1,131 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: magic
+          type: Exact
+          value: foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        headerMatches:
+        - distinct: false
+          exact: foo
+          name: magic
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/0/*
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.in.yaml
new file mode 100644
index 000000000..82e319fd2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.in.yaml
@@ -0,0 +1,39 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - method:
+          method: "Example"
+          service: "com.example"
+          type: Exact
+      - method:
+          method: "Foobar"
+          service: "foo.*"
+          type: RegularExpression
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.out.yaml
new file mode 100644
index 000000000..79a8f24a6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.out.yaml
@@ -0,0 +1,154 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - method:
+          method: Example
+          service: com.example
+          type: Exact
+      - method:
+          method: Foobar
+          service: foo.*
+          type: RegularExpression
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /com.example/Example
+          name: ""
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/1/*
+        pathMatch:
+          distinct: false
+          name: ""
+          safeRegex: /foo.*/Foobar
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.in.yaml
new file mode 100644
index 000000000..e2a374d14
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.in.yaml
@@ -0,0 +1,37 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - method:
+          method: ExampleExact
+          type: Exact
+      - method:
+          method: FooBar[0-9]+
+          type: RegularExpression
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.out.yaml
new file mode 100644
index 000000000..e63d54ce4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.out.yaml
@@ -0,0 +1,152 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - method:
+          method: ExampleExact
+          type: Exact
+      - method:
+          method: FooBar[0-9]+
+          type: RegularExpression
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/1/*
+        pathMatch:
+          distinct: false
+          name: ""
+          safeRegex: /(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*/FooBar[0-9]+
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        headerMatches:
+        - distinct: false
+          name: :path
+          suffix: /ExampleExact
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/0/*
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.in.yaml
new file mode 100644
index 000000000..2c48dad58
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.in.yaml
@@ -0,0 +1,36 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - filters:
+      - type: "RequestHeaderModifier"
+        requestHeaderModifier:
+          add:
+          - name: "my-header"
+            value: "foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.out.yaml
new file mode 100644
index 000000000..6bc3ca36f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.out.yaml
@@ -0,0 +1,132 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: my-header
+            value: foo
+        type: RequestHeaderModifier
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addRequestHeaders:
+        - append: true
+          name: my-header
+          value: foo
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.in.yaml
new file mode 100644
index 000000000..ad245cb18
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.in.yaml
@@ -0,0 +1,37 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - method:
+          service: com.ExampleExact
+          type: Exact
+      - method:
+          service: com.[A-Z]+
+          type: RegularExpression
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.out.yaml
new file mode 100644
index 000000000..0c7c7c743
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.out.yaml
@@ -0,0 +1,152 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - method:
+          service: com.ExampleExact
+          type: Exact
+      - method:
+          service: com.[A-Z]+
+          type: RegularExpression
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/1/*
+        pathMatch:
+          distinct: false
+          name: ""
+          safeRegex: /com.[A-Z]+/[A-Za-z_][A-Za-z_0-9]*
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /com.ExampleExact
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.in.yaml
new file mode 100644
index 000000000..3d3adbd5a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.in.yaml
@@ -0,0 +1,54 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      timeouts:
+        request: 1s
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      tcp:
+        connectTimeout: 20kib
+      http:
+        maxConnectionDuration: 22s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
new file mode 100644
index 000000000..7573ae622
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
@@ -0,0 +1,169 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      http:
+        maxConnectionDuration: 22s
+      tcp:
+        connectTimeout: 20kib
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: 'Timeout: invalid ConnectTimeout value 20kib'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+      timeouts:
+        request: 1s
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        timeout:
+          http:
+            requestTimeout: 1s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.in.yaml
new file mode 100644
index 000000000..d399d2f6e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.in.yaml
@@ -0,0 +1,100 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      timeouts:
+        request: 1s
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      tcp:
+        connectTimeout: 15s
+      http:
+        connectionIdleTimeout: 16s
+        maxConnectionDuration: 17s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      tcp:
+        connectTimeout: 20s
+      http:
+        maxConnectionDuration: 22s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
new file mode 100644
index 000000000..82870b6b5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
@@ -0,0 +1,329 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      http:
+        maxConnectionDuration: 22s
+      tcp:
+        connectTimeout: 20s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      http:
+        connectionIdleTimeout: 16s
+        maxConnectionDuration: 17s
+      tcp:
+        connectTimeout: 15s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+      timeouts:
+        request: 1s
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        timeout:
+          http:
+            connectionIdleTimeout: 16s
+            maxConnectionDuration: 17s
+          tcp:
+            connectTimeout: 15s
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        timeout:
+          http:
+            maxConnectionDuration: 22s
+            requestTimeout: 1s
+          tcp:
+            connectTimeout: 20s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.in.yaml
new file mode 100644
index 000000000..d44d02d16
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.in.yaml
@@ -0,0 +1,82 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 81
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-2
+          protocol: HTTP
+          port: 82
+          hostname: bar.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-3
+          protocol: HTTP
+          port: 83
+          hostname: foo1.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-4
+          protocol: HTTP
+          port: 84
+          hostname: bar1.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-5
+          protocol: HTTP
+          port: 85
+          hostname: foo2.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-6
+          protocol: HTTP
+          port: 86
+          hostname: bar2.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-7
+          protocol: HTTP
+          port: 87
+          hostname: foo3.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-8
+          protocol: HTTP
+          port: 88
+          hostname: bar3.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
new file mode 100644
index 000000000..e7aaca900
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
@@ -0,0 +1,590 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 81
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 82
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo1.com
+      name: http-3
+      port: 83
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar1.com
+      name: http-4
+      port: 84
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo2.com
+      name: http-5
+      port: 85
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar2.com
+      name: http-6
+      port: 86
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo3.com
+      name: http-7
+      port: 87
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar3.com
+      name: http-8
+      port: 88
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-3
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-4
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-5
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-6
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-7
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-8
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10081
+          name: http-1
+          protocol: HTTP
+          servicePort: 81
+      - address: null
+        name: envoy-gateway/gateway-1/http-2
+        ports:
+        - containerPort: 10082
+          name: http-2
+          protocol: HTTP
+          servicePort: 82
+      - address: null
+        name: envoy-gateway/gateway-1/http-3
+        ports:
+        - containerPort: 10083
+          name: http-3
+          protocol: HTTP
+          servicePort: 83
+      - address: null
+        name: envoy-gateway/gateway-1/http-4
+        ports:
+        - containerPort: 10084
+          name: http-4
+          protocol: HTTP
+          servicePort: 84
+      - address: null
+        name: envoy-gateway/gateway-1/http-5
+        ports:
+        - containerPort: 10085
+          name: http-5
+          protocol: HTTP
+          servicePort: 85
+      - address: null
+        name: envoy-gateway/gateway-1/http-6
+        ports:
+        - containerPort: 10086
+          name: http-6
+          protocol: HTTP
+          servicePort: 86
+      - address: null
+        name: envoy-gateway/gateway-1/http-7
+        ports:
+        - containerPort: 10087
+          name: http-7
+          protocol: HTTP
+          servicePort: 87
+      - address: null
+        name: envoy-gateway/gateway-1/http-8
+        ports:
+        - containerPort: 10088
+          name: http-8
+          protocol: HTTP
+          servicePort: 88
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10081
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10082
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo1.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-3
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10083
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo1.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo1_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar1.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-4
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10084
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar1.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar1_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo2.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-5
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10085
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo2_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar2.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-6
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10086
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar2_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo3.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-7
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10087
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo3.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo3_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar3.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-8
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10088
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar3.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar3_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.in.yaml
new file mode 100644
index 000000000..d2078deb7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.in.yaml
@@ -0,0 +1,82 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 80
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-2
+          protocol: HTTP
+          port: 80
+          hostname: bar.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-3
+          protocol: HTTP
+          port: 80
+          hostname: foo1.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-4
+          protocol: HTTP
+          port: 80
+          hostname: bar1.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-5
+          protocol: HTTP
+          port: 80
+          hostname: foo2.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-6
+          protocol: HTTP
+          port: 80
+          hostname: bar2.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-7
+          protocol: HTTP
+          port: 80
+          hostname: foo3.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-8
+          protocol: HTTP
+          port: 80
+          hostname: bar3.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
new file mode 100644
index 000000000..5f127b4a2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
@@ -0,0 +1,541 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo1.com
+      name: http-3
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar1.com
+      name: http-4
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo2.com
+      name: http-5
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar2.com
+      name: http-6
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo3.com
+      name: http-7
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar3.com
+      name: http-8
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-3
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-4
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-5
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-6
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-7
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-8
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-1
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo1.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-3
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo1.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo1_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar1.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-4
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar1.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar1_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo2.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-5
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo2_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar2.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-6
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar2_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo3.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-7
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo3.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo3_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar3.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-8
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar3.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar3_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.in.yaml
new file mode 100644
index 000000000..2a5c0e34b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.in.yaml
@@ -0,0 +1,52 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
new file mode 100644
index 000000000..3825b8ac8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
@@ -0,0 +1,203 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10443
+          name: tls
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: envoy-gateway/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.in.yaml
new file mode 100644
index 000000000..8b11c8da7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.in.yaml
@@ -0,0 +1,40 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 80
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-2
+          protocol: HTTP
+          port: 80
+          hostname: bar.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
new file mode 100644
index 000000000..b419de26e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
@@ -0,0 +1,187 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-1
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.in.yaml
new file mode 100644
index 000000000..2946dfeb1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.in.yaml
@@ -0,0 +1,32 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.out.yaml
new file mode 100644
index 000000000..691ad8691
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.out.yaml
@@ -0,0 +1,127 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.in.yaml
new file mode 100644
index 000000000..ec02f8881
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.in.yaml
@@ -0,0 +1,34 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+          port: 80
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.out.yaml
new file mode 100644
index 000000000..e7b2a7053
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.out.yaml
@@ -0,0 +1,131 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      port: 80
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        port: 80
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.in.yaml
new file mode 100644
index 000000000..bc9aba4dd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.in.yaml
@@ -0,0 +1,41 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 80
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-2
+          protocol: HTTP
+          port: 80
+          hostname: bar.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http-2
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
new file mode 100644
index 000000000..6b6523e55
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
@@ -0,0 +1,169 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http-2
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-2
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-1
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+    - address: 0.0.0.0
+      hostnames:
+      - bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.in.yaml
new file mode 100644
index 000000000..0c00de607
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.in.yaml
@@ -0,0 +1,99 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              port: 8080
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-2
+              port: 8081
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-2
+    spec:
+      ips:
+        - 8.8.8.8
+      ports:
+        - port: 8081
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: FQDN
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "foo.bar"
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-2
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-2
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8081
+    endpoints:
+      - addresses:
+          - "1.2.3.4"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
new file mode 100644
index 000000000..87823b3a9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
@@ -0,0 +1,141 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        port: 8080
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-2
+        port: 8081
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Mixed endpointslice address type between backendRefs is not supported
+        reason: ResolvedRefs
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: FQDN
+            endpoints:
+            - host: foo.bar
+              port: 8080
+            protocol: HTTP
+            weight: 1
+          - addressType: IP
+            endpoints:
+            - host: 1.2.3.4
+              port: 8081
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.in.yaml
new file mode 100644
index 000000000..8ad5fa129
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.in.yaml
@@ -0,0 +1,99 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              port: 8080
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-2
+              port: 8081
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-2
+    spec:
+      ips:
+        - 8.8.8.8
+      ports:
+        - port: 8081
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: FQDN
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "foo.bar"
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-2
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-2
+    addressType: FQDN
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8081
+    endpoints:
+      - addresses:
+          - "bar.foo"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
new file mode 100644
index 000000000..5fe7303cc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
@@ -0,0 +1,141 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        port: 8080
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-2
+        port: 8081
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: FQDN
+            endpoints:
+            - host: foo.bar
+              port: 8080
+            protocol: HTTP
+            weight: 1
+          - addressType: FQDN
+            endpoints:
+            - host: bar.foo
+              port: 8081
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.in.yaml
new file mode 100644
index 000000000..7fa56a4ae
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.in.yaml
@@ -0,0 +1,66 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              port: 8080
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: FQDN
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "foo.bar"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
new file mode 100644
index 000000000..d243d7e8d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
@@ -0,0 +1,131 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: FQDN
+            endpoints:
+            - host: foo.bar
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.in.yaml
new file mode 100644
index 000000000..c58ed15d3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.in.yaml
@@ -0,0 +1,83 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              port: 8080
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "1.2.3.4"
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-2
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: FQDN
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8081
+    endpoints:
+      - addresses:
+          - "foo.bar"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
new file mode 100644
index 000000000..690b29467
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
@@ -0,0 +1,133 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Mixed endpointslice address type for the same backendRef is not supported
+        reason: ResolvedRefs
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: Mixed
+            endpoints:
+            - host: 1.2.3.4
+              port: 8080
+            - host: foo.bar
+              port: 8081
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.in.yaml
new file mode 100644
index 000000000..26a816b93
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.in.yaml
@@ -0,0 +1,66 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              port: 8080
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "8.8.8.8"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
new file mode 100644
index 000000000..6188955f5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
@@ -0,0 +1,131 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 8.8.8.8
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.in.yaml
new file mode 100644
index 000000000..6766b18f5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.out.yaml
new file mode 100644
index 000000000..d4796986c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.out.yaml
@@ -0,0 +1,129 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.in.yaml
new file mode 100644
index 000000000..f16077de3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          timeouts:
+            backendRequest: 1s
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.out.yaml
new file mode 100644
index 000000000..8d3b1b91e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.out.yaml
@@ -0,0 +1,134 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+      timeouts:
+        backendRequest: 1s
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        timeout:
+          http:
+            requestTimeout: 1s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.in.yaml
new file mode 100644
index 000000000..006001996
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.in.yaml
@@ -0,0 +1,34 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 80
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          port: 81
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
new file mode 100644
index 000000000..776f3dc5c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
@@ -0,0 +1,110 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      port: 81
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners match this parent ref
+        reason: NoMatchingParent
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        port: 81
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-1
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.in.yaml
new file mode 100644
index 000000000..6cf2210aa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          timeouts:
+            request: 5s
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.out.yaml
new file mode 100644
index 000000000..6318ac412
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.out.yaml
@@ -0,0 +1,134 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+      timeouts:
+        request: 5s
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        timeout:
+          http:
+            requestTimeout: 5s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.in.yaml
new file mode 100644
index 000000000..ba4acbbc7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
new file mode 100644
index 000000000..6ab06d6c2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
@@ -0,0 +1,117 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.in.yaml
new file mode 100644
index 000000000..2e9cddb58
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.in.yaml
@@ -0,0 +1,36 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+            - name: service-2
+              port: 8080
+            - name: service-3
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
new file mode 100644
index 000000000..6f1fc5101
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
@@ -0,0 +1,143 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      - name: service-2
+        port: 8080
+      - name: service-3
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.in.yaml
new file mode 100644
index 000000000..e3419de8d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+              weight: 1
+            - name: service-2
+              port: 8080
+              weight: 2
+            - name: service-3
+              port: 8080
+              weight: 3
+            - name: service-4
+              port: 8080
+              weight: 0
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
new file mode 100644
index 000000000..cb32420be
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
@@ -0,0 +1,149 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+        weight: 1
+      - name: service-2
+        port: 8080
+        weight: 2
+      - name: service-3
+        port: 8080
+        weight: 3
+      - name: service-4
+        port: 8080
+        weight: 0
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 2
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 3
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
new file mode 100644
index 000000000..c1d5723e7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
@@ -0,0 +1,79 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              namespace: backends
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: backends
+      name: service-1
+    spec:
+      clusterIP: 1.1.1.1
+      ports:
+        - name: http
+          port: 8080
+          protocol: TCP
+          targetPort: 8080
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-service-1
+      namespace: backends
+      labels:
+        kubernetes.io/service-name: service-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "7.7.7.7"
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: backends
+      name: referencegrant-1
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: default
+      to:
+        - group: ""
+          kind: Service
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
new file mode 100644
index 000000000..faf1be2da
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -0,0 +1,129 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.in.yaml
new file mode 100644
index 000000000..e445c5636
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.in.yaml
@@ -0,0 +1,81 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              namespace: backends
+              port: 8080
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: backends
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: backends
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "8.8.8.8"
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: backends
+      name: referencegrant-1
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: default
+      to:
+        - group: multicluster.x-k8s.io
+          kind: ServiceImport
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
new file mode 100644
index 000000000..5eed2bb32
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -0,0 +1,131 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 8.8.8.8
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.in.yaml
new file mode 100644
index 000000000..14755bccb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.in.yaml
@@ -0,0 +1,31 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.out.yaml
new file mode 100644
index 000000000..bcf7af32c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.out.yaml
@@ -0,0 +1,122 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/-1/*
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.in.yaml
new file mode 100644
index 000000000..d98ef6905
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.in.yaml
@@ -0,0 +1,52 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          add:
+          - name: "add-header-1"
+            value: "some-value"
+          - name: "add-header-2"
+            value: "some-value"
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          add:
+          - name: "add-header-1"
+            value: "some-value"
+          - name: "add-header-3"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
new file mode 100644
index 000000000..b9e0b9be4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
@@ -0,0 +1,157 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: add-header-1
+            value: some-value
+          - name: add-header-2
+            value: some-value
+        type: RequestHeaderModifier
+      - requestHeaderModifier:
+          add:
+          - name: add-header-1
+            value: some-value
+          - name: add-header-3
+            value: some-value
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addRequestHeaders:
+        - append: true
+          name: add-header-1
+          value: some-value
+        - append: true
+          name: add-header-2
+          value: some-value
+        - append: true
+          name: add-header-3
+          value: some-value
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.in.yaml
new file mode 100644
index 000000000..ccae4c43a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.in.yaml
@@ -0,0 +1,61 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: "set-header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-4"
+            value: "some-value"
+          - name: "set-header-4"
+            value: "some-value"
+          add:
+          - name: "Set-Header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-5"
+            value: "some-value"
+          - name: "set-header-5"
+            value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
new file mode 100644
index 000000000..69c6f158c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
@@ -0,0 +1,173 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: Set-Header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-5
+            value: some-value
+          - name: set-header-5
+            value: some-value
+          set:
+          - name: set-header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-4
+            value: some-value
+          - name: set-header-4
+            value: some-value
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addRequestHeaders:
+        - append: true
+          name: Set-Header-1
+          value: some-value
+        - append: true
+          name: set-header-2
+          value: some-value
+        - append: true
+          name: set-header-3
+          value: some-value
+        - append: true
+          name: set-header-5
+          value: some-value
+        - append: false
+          name: set-header-4
+          value: some-value
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.in.yaml
new file mode 100644
index 000000000..9f142279a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          remove:
+          - "rem-header-1"
+          - "rem-header-2"
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          remove:
+          - "rem-header-1"
+          - "rem-header-3"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
new file mode 100644
index 000000000..8e57d7c08
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
@@ -0,0 +1,147 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          remove:
+          - rem-header-1
+          - rem-header-2
+        type: RequestHeaderModifier
+      - requestHeaderModifier:
+          remove:
+          - rem-header-1
+          - rem-header-3
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeRequestHeaders:
+        - rem-header-1
+        - rem-header-2
+        - rem-header-3
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.in.yaml
new file mode 100644
index 000000000..347d58dca
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          remove:
+          - "some-header-1"
+          - "some-header-1"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
new file mode 100644
index 000000000..62bc219c0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
@@ -0,0 +1,140 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          remove:
+          - some-header-1
+          - some-header-1
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeRequestHeaders:
+        - some-header-1
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.in.yaml
new file mode 100644
index 000000000..5c8103861
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.in.yaml
@@ -0,0 +1,46 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: "example-header-1"
+            value: ""
+          add:
+          - name: "example-header-2"
+            value: ""
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.out.yaml
new file mode 100644
index 000000000..600bf0fa8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.out.yaml
@@ -0,0 +1,148 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: example-header-2
+            value: ""
+          set:
+          - name: example-header-1
+            value: ""
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addRequestHeaders:
+        - append: true
+          name: example-header-2
+          value: ""
+        - append: false
+          name: example-header-1
+          value: ""
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.in.yaml
new file mode 100644
index 000000000..b6659fa32
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: ""
+            value: "some-value"
+          add:
+          - name: ""
+            value: "some-value"
+          - name: "good-header"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.out.yaml
new file mode 100644
index 000000000..fc890c1f4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.out.yaml
@@ -0,0 +1,123 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: ""
+            value: some-value
+          - name: good-header
+            value: some-value
+          set:
+          - name: ""
+            value: some-value
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: RequestHeaderModifier Filter cannot set a header with an empty name
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.in.yaml
new file mode 100644
index 000000000..cec0b7702
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: "example:1"
+            value: "some-value"
+          - name: "good-header"
+            value: "some-value"
+          add:
+          - name: "example/2"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.out.yaml
new file mode 100644
index 000000000..a224d9440
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.out.yaml
@@ -0,0 +1,124 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: example/2
+            value: some-value
+          set:
+          - name: example:1
+            value: some-value
+          - name: good-header
+            value: some-value
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'RequestHeaderModifier Filter cannot set headers with a ''/'' or
+          '':'' character in them. Header: ''example:1'''
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.in.yaml
new file mode 100644
index 000000000..c7b7cc8a8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          add:
+          set:
+          remove:
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.out.yaml
new file mode 100644
index 000000000..8da34b9aa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.out.yaml
@@ -0,0 +1,135 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier: {}
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.in.yaml
new file mode 100644
index 000000000..982138ca2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          add:
+          - name: "bad:header"
+            value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
new file mode 100644
index 000000000..26599e6ce
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
@@ -0,0 +1,119 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: bad:header
+            value: some-value
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: RequestHeaderModifier Filter did not provide valid configuration
+          to add/set/remove any headers
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.in.yaml
new file mode 100644
index 000000000..48d62f8d0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          remove:
+          - "example-header-1"
+          - "example-header-2"
+          - "example-header-3"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.out.yaml
new file mode 100644
index 000000000..800dbf826
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.out.yaml
@@ -0,0 +1,143 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          remove:
+          - example-header-1
+          - example-header-2
+          - example-header-3
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeRequestHeaders:
+        - example-header-1
+        - example-header-2
+        - example-header-3
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.in.yaml
new file mode 100644
index 000000000..85d2eabc2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          type: Exact
+          value: "/exact"
+      backendRefs:
+      - name: service-1
+        port: 8888
+services:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    name: service-1
+  spec:
+    clusterIP: 7.7.7.7
+    ports:
+    - port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
new file mode 100644
index 000000000..8f1ea3e60
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
@@ -0,0 +1,121 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8888
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: TCP Port 8888 not found on service default/service-1
+        reason: PortNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.in.yaml
new file mode 100644
index 000000000..66905669e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.in.yaml
@@ -0,0 +1,45 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              group: "invalid"
+              namespace: backends
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: backends
+      name: service-1
+    spec:
+      clusterIP: 7.7.7.7
+      ports:
+        - port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
new file mode 100644
index 000000000..59dc0c3dd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
@@ -0,0 +1,125 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - group: invalid
+        name: service-1
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Group is invalid, only the core API group (specified by omitting
+          the group field or setting it to an empty string) and multicluster.x-k8s.io
+          are supported
+        reason: InvalidKind
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.in.yaml
new file mode 100644
index 000000000..8914c502c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              kind: "URL"
+              port: 8080
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
new file mode 100644
index 000000000..0009e0dc3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
@@ -0,0 +1,122 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - kind: URL
+        name: service-1
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Kind is invalid, only Service and MCS ServiceImport are supported
+        reason: InvalidKind
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.in.yaml
new file mode 100644
index 000000000..90664bbd4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.in.yaml
@@ -0,0 +1,41 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: service-1
+    spec:
+      clusterIP: 7.7.7.7
+      ports:
+        - port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
new file mode 100644
index 000000000..1a5fdd9e7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
@@ -0,0 +1,121 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: A valid port number corresponding to a port on the Service must be
+          specified
+        reason: PortNotSpecified
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.in.yaml
new file mode 100644
index 000000000..35593cde2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-that-doesnt-exist
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
new file mode 100644
index 000000000..0fdd26254
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
@@ -0,0 +1,123 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-that-doesnt-exist
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: ServiceImport default/service-import-that-doesnt-exist not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.in.yaml
new file mode 100644
index 000000000..d56d23d0c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-that-doesnt-exist
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
new file mode 100644
index 000000000..73fbe7166
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
@@ -0,0 +1,121 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-that-doesnt-exist
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service default/service-that-doesnt-exist not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.in.yaml
new file mode 100644
index 000000000..236a10736
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.in.yaml
@@ -0,0 +1,39 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          type: Exact
+          value: "/exact"
+      backendRefs:
+      - name: service-1
+        port: 8080
+        filters:
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+            - name: "set-header-1"
+              value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
new file mode 100644
index 000000000..30cdf9673
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
@@ -0,0 +1,127 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - filters:
+        - responseHeaderModifier:
+            set:
+            - name: set-header-1
+              value: some-value
+          type: ResponseHeaderModifier
+        name: service-1
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: The filters field within BackendRef is not supported
+        reason: UnsupportedRefValue
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.in.yaml
new file mode 100644
index 000000000..833ca4ad0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.in.yaml
@@ -0,0 +1,44 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              namespace: backends
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: backends
+      name: service-1
+    spec:
+      clusterIP: 7.7.7.7
+      ports:
+        - port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
new file mode 100644
index 000000000..b74619520
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
@@ -0,0 +1,122 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Backend ref to Service backends/service-1 not permitted by any ReferenceGrant.
+        reason: RefNotPermitted
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.in.yaml
new file mode 100644
index 000000000..1b114bdc5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-2
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 81
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+
+      rules:
+        - matches:
+            - path:
+                type: RegularExpression
+                value: "*.foo.bar.com"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.out.yaml
new file mode 100644
index 000000000..a71a4cee6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.out.yaml
@@ -0,0 +1,173 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 81
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          type: RegularExpression
+          value: '*.foo.bar.com'
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Regex "*.foo.bar.com" is invalid: error parsing regexp: missing
+          argument to repetition operator: `*`'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10081
+          name: http
+          protocol: HTTP
+          servicePort: 81
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10081
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.in.yaml
new file mode 100644
index 000000000..9b21f53ce
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.out.yaml
new file mode 100644
index 000000000..ad7c1b832
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.out.yaml
@@ -0,0 +1,162 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+        type: RequestMirror
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+        type: RequestMirror
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        mirrors:
+        - name: httproute/default/httproute-1/rule/0-mirror-0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        - name: httproute/default/httproute-1/rule/0-mirror-1
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.in.yaml
new file mode 100644
index 000000000..0e7fe4865
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.in.yaml
@@ -0,0 +1,62 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: X-Header-Set
+            value: set-overwrites-values
+          add:
+          - name: X-Header-Add
+            value: header-val-1
+          - name: X-Header-Add-Append
+            value: header-val-2
+          remove:
+          - X-Header-Remove
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: mirror-service
+            port: 8080
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.out.yaml
new file mode 100644
index 000000000..9c1575888
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.out.yaml
@@ -0,0 +1,186 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: X-Header-Add
+            value: header-val-1
+          - name: X-Header-Add-Append
+            value: header-val-2
+          remove:
+          - X-Header-Remove
+          set:
+          - name: X-Header-Set
+            value: set-overwrites-values
+        type: RequestHeaderModifier
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+        type: RequestMirror
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: mirror-service
+            port: 8080
+        type: RequestMirror
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addRequestHeaders:
+        - append: true
+          name: X-Header-Add
+          value: header-val-1
+        - append: true
+          name: X-Header-Add-Append
+          value: header-val-2
+        - append: false
+          name: X-Header-Set
+          value: set-overwrites-values
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        mirrors:
+        - name: httproute/default/httproute-1/rule/0-mirror-1
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        - name: httproute/default/httproute-1/rule/0-mirror-2
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.6.5.4
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeRequestHeaders:
+        - X-Header-Remove
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.in.yaml
new file mode 100644
index 000000000..3c5204ca2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
new file mode 100644
index 000000000..8eaec664b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
@@ -0,0 +1,139 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+        type: RequestMirror
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: A valid port number corresponding to a port on the Service must be
+          specified
+        reason: PortNotSpecified
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.in.yaml
new file mode 100644
index 000000000..bd9b63a40
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-unknown
+            port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
new file mode 100644
index 000000000..0255c22dc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
@@ -0,0 +1,139 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-unknown
+            port: 8080
+        type: RequestMirror
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service default/service-unknown not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.in.yaml
new file mode 100644
index 000000000..526e5c01c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.out.yaml
new file mode 100644
index 000000000..139d70fca
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.out.yaml
@@ -0,0 +1,148 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+        type: RequestMirror
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        mirrors:
+        - name: httproute/default/httproute-1/rule/0-mirror-0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
new file mode 100644
index 000000000..51dd2e3d2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          hostname: "*.envoyproxy.io"
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      hostnames:
+        - whales.kubernetes.io
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
new file mode 100644
index 000000000..0f9e160ff
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -0,0 +1,111 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - whales.kubernetes.io
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There were no hostname intersections between the HTTPRoute and this
+          parent ref's Listener(s).
+        reason: NoMatchingListenerHostname
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.in.yaml
new file mode 100644
index 000000000..679d88528
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.in.yaml
@@ -0,0 +1,41 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: https
+          statusCode: 301
+          path:
+            type: ReplaceFullPath
+            replaceFullPath: /redirected
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
new file mode 100644
index 000000000..52c8fddab
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
@@ -0,0 +1,136 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - requestRedirect:
+          path:
+            replaceFullPath: /redirected
+            type: ReplaceFullPath
+          scheme: https
+          statusCode: 301
+        type: RequestRedirect
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        redirect:
+          hostname: null
+          path:
+            fullReplace: /redirected
+            prefixMatchReplace: null
+          port: 443
+          scheme: https
+          statusCode: 301
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.in.yaml
new file mode 100644
index 000000000..ab244b058
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.in.yaml
@@ -0,0 +1,39 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: https
+          statusCode: 301
+          hostname: "redirected.com"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.out.yaml
new file mode 100644
index 000000000..95c55f2d1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.out.yaml
@@ -0,0 +1,132 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - requestRedirect:
+          hostname: redirected.com
+          scheme: https
+          statusCode: 301
+        type: RequestRedirect
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        redirect:
+          hostname: redirected.com
+          path: null
+          port: 443
+          scheme: https
+          statusCode: 301
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.in.yaml
new file mode 100644
index 000000000..09583b2b6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: unsupported.group.io
+          kind: UnsupportedKind
+          name: unsupported
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
new file mode 100644
index 000000000..ae17d799a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
@@ -0,0 +1,118 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - extensionRef:
+          group: unsupported.group.io
+          kind: UnsupportedKind
+          name: unsupported
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Invalid filter ExtensionRef: unknown kind unsupported.group.io/UnsupportedKind'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.in.yaml
new file mode 100644
index 000000000..00fe8b6f7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.in.yaml
@@ -0,0 +1,38 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: unknown
+          statusCode: 301
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
new file mode 100644
index 000000000..9836a529f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
@@ -0,0 +1,115 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - requestRedirect:
+          scheme: unknown
+          statusCode: 301
+        type: RequestRedirect
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Scheme: unknown is unsupported, only ''https'' and ''http'' are
+          supported'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.in.yaml
new file mode 100644
index 000000000..134a1b3f9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.in.yaml
@@ -0,0 +1,39 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: https
+          statusCode: 666
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
new file mode 100644
index 000000000..66948bda2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
@@ -0,0 +1,114 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - requestRedirect:
+          scheme: https
+          statusCode: 666
+        type: RequestRedirect
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Status code 666 is invalid, only 302 and 301 are supported
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.in.yaml
new file mode 100644
index 000000000..593e057f7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: http
+          statusCode: 302
+          port: 8080
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /redirected
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
new file mode 100644
index 000000000..abbfe08b6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
@@ -0,0 +1,137 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - requestRedirect:
+          path:
+            replacePrefixMatch: /redirected
+            type: ReplacePrefixMatch
+          port: 8080
+          scheme: http
+          statusCode: 302
+        type: RequestRedirect
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        redirect:
+          hostname: null
+          path:
+            fullReplace: null
+            prefixMatchReplace: /redirected
+          port: 8080
+          scheme: http
+          statusCode: 302
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.in.yaml
new file mode 100644
index 000000000..73d50049d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.in.yaml
@@ -0,0 +1,57 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          set:
+          - name: "set-header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-4"
+            value: "some-value"
+          add:
+          - name: "Set-Header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-5"
+            value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.out.yaml
new file mode 100644
index 000000000..99721e5b0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.out.yaml
@@ -0,0 +1,169 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: Set-Header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-5
+            value: some-value
+          set:
+          - name: set-header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-4
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addResponseHeaders:
+        - append: true
+          name: Set-Header-1
+          value: some-value
+        - append: true
+          name: set-header-2
+          value: some-value
+        - append: true
+          name: set-header-3
+          value: some-value
+        - append: true
+          name: set-header-5
+          value: some-value
+        - append: false
+          name: set-header-4
+          value: some-value
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.in.yaml
new file mode 100644
index 000000000..d0d7618f7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.in.yaml
@@ -0,0 +1,52 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          add:
+          - name: "add-header-1"
+            value: "some-value"
+          - name: "add-header-2"
+            value: "some-value"
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          add:
+          - name: "add-header-1"
+            value: "some-value"
+          - name: "add-header-3"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
new file mode 100644
index 000000000..60e8c9fd1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
@@ -0,0 +1,157 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: add-header-1
+            value: some-value
+          - name: add-header-2
+            value: some-value
+        type: ResponseHeaderModifier
+      - responseHeaderModifier:
+          add:
+          - name: add-header-1
+            value: some-value
+          - name: add-header-3
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addResponseHeaders:
+        - append: true
+          name: add-header-1
+          value: some-value
+        - append: true
+          name: add-header-2
+          value: some-value
+        - append: true
+          name: add-header-3
+          value: some-value
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.in.yaml
new file mode 100644
index 000000000..882b82282
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.in.yaml
@@ -0,0 +1,61 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          set:
+          - name: "set-header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-4"
+            value: "some-value"
+          - name: "set-header-4"
+            value: "some-value"
+          add:
+          - name: "Set-Header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-5"
+            value: "some-value"
+          - name: "set-header-5"
+            value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
new file mode 100644
index 000000000..91a37eb93
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
@@ -0,0 +1,173 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: Set-Header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-5
+            value: some-value
+          - name: set-header-5
+            value: some-value
+          set:
+          - name: set-header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-4
+            value: some-value
+          - name: set-header-4
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addResponseHeaders:
+        - append: true
+          name: Set-Header-1
+          value: some-value
+        - append: true
+          name: set-header-2
+          value: some-value
+        - append: true
+          name: set-header-3
+          value: some-value
+        - append: true
+          name: set-header-5
+          value: some-value
+        - append: false
+          name: set-header-4
+          value: some-value
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.in.yaml
new file mode 100644
index 000000000..c1f62250c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          remove:
+          - "rem-header-1"
+          - "rem-header-2"
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          remove:
+          - "rem-header-1"
+          - "rem-header-3"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
new file mode 100644
index 000000000..ce339d0d7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
@@ -0,0 +1,147 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          remove:
+          - rem-header-1
+          - rem-header-2
+        type: ResponseHeaderModifier
+      - responseHeaderModifier:
+          remove:
+          - rem-header-1
+          - rem-header-3
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeResponseHeaders:
+        - rem-header-1
+        - rem-header-2
+        - rem-header-3
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.in.yaml
new file mode 100644
index 000000000..e77287f9e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          remove:
+          - "some-header-1"
+          - "some-header-1"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
new file mode 100644
index 000000000..07eb5708d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
@@ -0,0 +1,140 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          remove:
+          - some-header-1
+          - some-header-1
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeResponseHeaders:
+        - some-header-1
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.in.yaml
new file mode 100644
index 000000000..8a1383752
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.in.yaml
@@ -0,0 +1,46 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          set:
+          - name: "example-header-1"
+            value: ""
+          add:
+          - name: "example-header-2"
+            value: ""
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
new file mode 100644
index 000000000..5e6273a77
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
@@ -0,0 +1,148 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: example-header-2
+            value: ""
+          set:
+          - name: example-header-1
+            value: ""
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addResponseHeaders:
+        - append: true
+          name: example-header-2
+          value: ""
+        - append: false
+          name: example-header-1
+          value: ""
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.in.yaml
new file mode 100644
index 000000000..edddd1b5a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          set:
+          - name: ""
+            value: "some-value"
+          add:
+          - name: ""
+            value: "some-value"
+          - name: "good-header"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
new file mode 100644
index 000000000..7f394b273
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
@@ -0,0 +1,123 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: ""
+            value: some-value
+          - name: good-header
+            value: some-value
+          set:
+          - name: ""
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: ResponseHeaderModifier Filter cannot set a header with an empty name
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.in.yaml
new file mode 100644
index 000000000..93a13bbba
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          set:
+          - name: "example:1"
+            value: "some-value"
+          - name: "good-header"
+            value: "some-value"
+          add:
+          - name: "example/2"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
new file mode 100644
index 000000000..9c731253e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
@@ -0,0 +1,124 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: example/2
+            value: some-value
+          set:
+          - name: example:1
+            value: some-value
+          - name: good-header
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'ResponseHeaderModifier Filter cannot set headers with a ''/'' or
+          '':'' character in them. Header: ''example:1'''
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.in.yaml
new file mode 100644
index 000000000..c2331bdad
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          add:
+          set:
+          remove:
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.out.yaml
new file mode 100644
index 000000000..06d127d5f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.out.yaml
@@ -0,0 +1,135 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier: {}
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.in.yaml
new file mode 100644
index 000000000..4c29af176
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          add:
+          - name: "bad:header"
+            value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
new file mode 100644
index 000000000..72358a130
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
@@ -0,0 +1,119 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: bad:header
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: ResponseHeaderModifier Filter did not provide valid configuration
+          to add/set/remove any headers
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.in.yaml
new file mode 100644
index 000000000..1a793c4c0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          remove:
+          - "example-header-1"
+          - "example-header-2"
+          - "example-header-3"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.out.yaml
new file mode 100644
index 000000000..5665378d9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.out.yaml
@@ -0,0 +1,143 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          remove:
+          - example-header-1
+          - example-header-2
+          - example-header-3
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeResponseHeaders:
+        - example-header-1
+        - example-header-2
+        - example-header-3
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.in.yaml
new file mode 100644
index 000000000..af7ae3628
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
new file mode 100644
index 000000000..04b1c1ec3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
@@ -0,0 +1,128 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.in.yaml
new file mode 100644
index 000000000..ee0320816
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.in.yaml
@@ -0,0 +1,31 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - method: POST
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
new file mode 100644
index 000000000..9f1a599e7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
@@ -0,0 +1,126 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - method: POST
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        headerMatches:
+        - distinct: false
+          exact: POST
+          name: :method
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.in.yaml
new file mode 100644
index 000000000..2ec00c37a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.in.yaml
@@ -0,0 +1,63 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+              headers:
+                - name: Header-1
+                  type: Exact
+                  value: "exact"
+              queryParams:
+                - name: QueryParam-1
+                  type: Exact
+                  value: "exact"
+          backendRefs:
+            - name: service-1
+              port: 8080
+        - matches:
+            - path:
+                type: PathPrefix
+                value: "/prefix"
+          backendRefs:
+            - name: service-2
+              port: 8080
+        - matches:
+            - path:
+                type: RegularExpression
+                value: "*regex*"
+              headers:
+                - name: Header-1
+                  type: RegularExpression
+                  value: "*regex*"
+              queryParams:
+                - name: QueryParam-1
+                  type: RegularExpression
+                  value: "*regex*"
+          backendRefs:
+            - name: service-3
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
new file mode 100644
index 000000000..96d72ccde
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
@@ -0,0 +1,134 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: Header-1
+          type: Exact
+          value: exact
+        path:
+          type: Exact
+          value: /exact
+        queryParams:
+        - name: QueryParam-1
+          type: Exact
+          value: exact
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          type: PathPrefix
+          value: /prefix
+    - backendRefs:
+      - name: service-3
+        port: 8080
+      matches:
+      - headers:
+        - name: Header-1
+          type: RegularExpression
+          value: '*regex*'
+        path:
+          type: RegularExpression
+          value: '*regex*'
+        queryParams:
+        - name: QueryParam-1
+          type: RegularExpression
+          value: '*regex*'
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Regex "*regex*" is invalid: error parsing regexp: missing argument
+          to repetition operator: `*`'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.in.yaml
new file mode 100644
index 000000000..7709a6945
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.in.yaml
@@ -0,0 +1,37 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/pathprefix"
+              headers:
+                - name: Header-1
+                  value: Val-1
+                - name: Header-2
+                  value: Val-2
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
new file mode 100644
index 000000000..eb419ab3f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
@@ -0,0 +1,139 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: Header-1
+          value: Val-1
+        - name: Header-2
+          value: Val-2
+        path:
+          value: /pathprefix
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        headerMatches:
+        - distinct: false
+          exact: Val-1
+          name: Header-1
+        - distinct: false
+          exact: Val-2
+          name: Header-2
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /pathprefix
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.in.yaml
new file mode 100644
index 000000000..dbd94a92b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.in.yaml
@@ -0,0 +1,46 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-that-doesnt-exist
+              port: 8080
+            - name: service-that-doesnt-exist-2
+              port: 8080
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: service-1
+    spec:
+      clusterIP: 7.7.7.7
+      ports:
+        - port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
new file mode 100644
index 000000000..50eeb2a32
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
@@ -0,0 +1,132 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-that-doesnt-exist
+        port: 8080
+      - name: service-that-doesnt-exist-2
+        port: 8080
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service default/service-that-doesnt-exist-2 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 2
+          valid: 1
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
new file mode 100644
index 000000000..2ac69230a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          hostname: "*.envoyproxy.io"
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      hostnames:
+        - apk.wso2.com
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
new file mode 100644
index 000000000..bad0357f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -0,0 +1,130 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.in.yaml
new file mode 100644
index 000000000..acdb93654
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.in.yaml
@@ -0,0 +1,36 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          hostname: "*.envoyproxy.io"
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      hostnames:
+        - apk.wso2.com
+        - whales.envoyproxy.io
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
new file mode 100644
index 000000000..12d756935
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -0,0 +1,150 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    - whales.envoyproxy.io
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: whales.envoyproxy.io
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/whales_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.in.yaml
new file mode 100644
index 000000000..571a20a80
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplaceFullPath
+            replaceFullPath: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
new file mode 100644
index 000000000..c2572699c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
@@ -0,0 +1,142 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            replaceFullPath: /rewrite
+            type: ReplaceFullPath
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        urlRewrite:
+          path:
+            fullReplace: /rewrite
+            prefixMatchReplace: null
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.in.yaml
new file mode 100644
index 000000000..d1e4d2a0e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "rewrite.com"
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
new file mode 100644
index 000000000..b699829a2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
@@ -0,0 +1,144 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: rewrite.com
+          path:
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        urlRewrite:
+          hostname: rewrite.com
+          path:
+            fullReplace: null
+            prefixMatchReplace: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.in.yaml
new file mode 100644
index 000000000..bd20f47a9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.in.yaml
@@ -0,0 +1,40 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "rewrite.com"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
new file mode 100644
index 000000000..6eb871daf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
@@ -0,0 +1,138 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: rewrite.com
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        urlRewrite:
+          hostname: rewrite.com
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.in.yaml
new file mode 100644
index 000000000..26f989775
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.in.yaml
@@ -0,0 +1,41 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: urlrewrite.envoyproxy.io
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
new file mode 100644
index 000000000..01d889c79
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
@@ -0,0 +1,138 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: urlrewrite.envoyproxy.io
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        urlRewrite:
+          hostname: urlrewrite.envoyproxy.io
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.in.yaml
new file mode 100644
index 000000000..4226c48e0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "-rewrite.com"
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
new file mode 100644
index 000000000..1ae124802
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
@@ -0,0 +1,122 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: -rewrite.com
+          path:
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'hostname "-rewrite.com" is invalid: [a lowercase RFC 1123 subdomain
+          must consist of lower case alphanumeric characters, ''-'' or ''.'', and
+          must start and end with an alphanumeric character (e.g. ''example.com'',
+          regex used for validation is ''[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'')]'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.in.yaml
new file mode 100644
index 000000000..86d5f6bb1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "rewrite.com"
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplaceFullPath
+            replaceFullPath: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
new file mode 100644
index 000000000..a56ea1e8f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
@@ -0,0 +1,124 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: rewrite.com
+          path:
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            replaceFullPath: /rewrite
+            type: ReplaceFullPath
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Cannot configure multiple urlRewrite filters for a single HTTPRouteRule
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.in.yaml
new file mode 100644
index 000000000..4da7aa982
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "rewrite.com"
+          path:
+            type: ReplacePrefixMatches
+            replacePrefixMatch: /rewrites
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
new file mode 100644
index 000000000..6f119ee91
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
@@ -0,0 +1,120 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: rewrite.com
+          path:
+            replacePrefixMatch: /rewrites
+            type: ReplacePrefixMatches
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Rewrite path type: ReplacePrefixMatches is invalid, only "ReplaceFullPath"
+          and "ReplacePrefixMatch" are supported'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.in.yaml
new file mode 100644
index 000000000..63c23fa10
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
+            replaceFullPath: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
new file mode 100644
index 000000000..d5c133ea9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
@@ -0,0 +1,119 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            replaceFullPath: /rewrite
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: ReplaceFullPath cannot be set when rewrite path type is "ReplacePrefixMatch"
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.in.yaml
new file mode 100644
index 000000000..1b3c47b9a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.in.yaml
@@ -0,0 +1,41 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplacePrefixMatch
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
new file mode 100644
index 000000000..99390c3fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
@@ -0,0 +1,117 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplacePrefixMatch
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: ReplacePrefixMatch must be set when rewrite path type is "ReplacePrefixMatch"
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.in.yaml
new file mode 100644
index 000000000..057561938
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
new file mode 100644
index 000000000..26845a2d1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
@@ -0,0 +1,142 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        urlRewrite:
+          path:
+            fullReplace: null
+            prefixMatchReplace: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.in.yaml
new file mode 100644
index 000000000..d61cae049
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.in.yaml
@@ -0,0 +1,34 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      hostnames:
+        - "*.envoyproxy.io"
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
new file mode 100644
index 000000000..ddfe368cd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
@@ -0,0 +1,129 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - '*.envoyproxy.io'
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*.envoyproxy.io'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.in.yaml
new file mode 100644
index 000000000..7315f3f4f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.in.yaml
@@ -0,0 +1,189 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - "*.com"
+    - "*.net"
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-2
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - example.com
+    rules:
+    - matches:
+      - path:
+          value: "/v1/example"
+        queryParams:
+        - name: "debug"
+          value: "yes"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-3
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - example.com
+    rules:
+    - matches:
+      - path:
+          value: "/v1/example"
+      backendRefs:
+      - name: service-2
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-4
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - example.net
+    rules:
+    - matches:
+      - path:
+          value: "/v1/status"
+        headers:
+        - name: "version"
+          value: "one"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-5
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - example.net
+    rules:
+    - matches:
+      - path:
+          value: "/v1/status"
+      backendRefs:
+      - name: service-2
+        port: 8080
+services:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: envoy-gateway
+    name: service-1
+  spec:
+    clusterIP: 1.1.1.1
+    ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: envoy-gateway
+    name: service-2
+  spec:
+    clusterIP: 2.2.2.2
+    ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-service-1
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: service-1
+  addressType: IPv4
+  ports:
+  - name: http
+    protocol: TCP
+    port: 8080
+  endpoints:
+  - addresses:
+    - "7.7.7.7"
+    conditions:
+      ready: true
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-service-2
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: service-2
+  addressType: IPv4
+  ports:
+  - name: http
+    protocol: TCP
+    port: 8080
+  endpoints:
+  - addresses:
+    - "8.8.8.8"
+    conditions:
+      ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.out.yaml
new file mode 100644
index 000000000..242b63714
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.out.yaml
@@ -0,0 +1,436 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 6
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - '*.com'
+    - '*.net'
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /v1/example
+        queryParams:
+        - name: debug
+          value: "yes"
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-3
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /v1/example
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-4
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - example.net
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: version
+          value: one
+        path:
+          value: /v1/status
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-5
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - example.net
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /v1/status
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: example.com
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-2/rule/0/match/0/example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v1/example
+        queryParamMatches:
+        - distinct: false
+          exact: "yes"
+          name: debug
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-3/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 8.8.8.8
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: example.com
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-3/rule/0/match/0/example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v1/example
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-4/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        headerMatches:
+        - distinct: false
+          exact: one
+          name: version
+        hostname: example.net
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-4/rule/0/match/0/example_net
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v1/status
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-5/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 8.8.8.8
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: example.net
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-5/rule/0/match/0/example_net
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v1/status
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*.com'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*.net'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*_net
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.in.yaml b/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.in.yaml
new file mode 100644
index 000000000..daf66d677
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.in.yaml
@@ -0,0 +1,34 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-1
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-2
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+        - name: udp
+          port: 80
+          protocol: UDP
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.out.yaml b/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.out.yaml
new file mode 100644
index 000000000..2481d8918
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.out.yaml
@@ -0,0 +1,147 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+    - name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Port, protocol and hostname tuple must be unique for every listener
+        reason: HostnameConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-2/udp
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-2/udp
+          protocol: UDP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.in.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.in.yaml
new file mode 100644
index 000000000..662a2381a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.in.yaml
@@ -0,0 +1,45 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-1
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Same
+        - name: http-2
+          hostname: company.com
+          port: 8888
+          protocol: HTTP
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-2
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-3
+          port: 8888
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Same
+        - name: http-4
+          hostname: example.com
+          port: 8888
+          protocol: HTTP
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
new file mode 100755
index 000000000..4d162ad5d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
@@ -0,0 +1,210 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+    - hostname: company.com
+      name: http-2
+      port: 8888
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http-3
+      port: 8888
+      protocol: HTTP
+    - hostname: example.com
+      name: http-4
+      port: 8888
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-3
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-4
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-1/http-2
+        ports:
+        - containerPort: 8888
+          name: envoy-gateway/gateway-1/http-2
+          protocol: HTTP
+          servicePort: 8888
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+    - address: 0.0.0.0
+      hostnames:
+      - company.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-3
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
+    - address: 0.0.0.0
+      hostnames:
+      - example.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-4
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.in.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.in.yaml
new file mode 100644
index 000000000..07203553a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.in.yaml
@@ -0,0 +1,81 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-2
+      port: 8888
+      protocol: HTTP
+    - name: http-3
+      hostname: example.com
+      port: 8888
+      protocol: HTTP
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http-3
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-2
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
new file mode 100644
index 000000000..3ee2965a4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
@@ -0,0 +1,292 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-2
+      port: 8888
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: example.com
+      name: http-3
+      port: 8888
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-3
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - example.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http-3
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http-3
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-2/http-2
+        ports:
+        - containerPort: 8888
+          name: envoy-gateway/gateway-2/http-2
+          protocol: HTTP
+          servicePort: 8888
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
+    - address: 0.0.0.0
+      hostnames:
+      - example.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-3
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: example.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.in.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.in.yaml
new file mode 100644
index 000000000..821dd97b6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.in.yaml
@@ -0,0 +1,41 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-1
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Same
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-2
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-2
+          port: 8888
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Same
+        - name: http-3
+          hostname: example.com
+          port: 8888
+          protocol: HTTP
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.out.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.out.yaml
new file mode 100644
index 000000000..974e1f0f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.out.yaml
@@ -0,0 +1,174 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http-2
+      port: 8888
+      protocol: HTTP
+    - hostname: example.com
+      name: http-3
+      port: 8888
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-3
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-2/http-2
+        ports:
+        - containerPort: 8888
+          name: envoy-gateway/gateway-2/http-2
+          protocol: HTTP
+          servicePort: 8888
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
+    - address: 0.0.0.0
+      hostnames:
+      - example.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-3
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.in.yaml
new file mode 100644
index 000000000..0b4c43f85
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    cors:
+      allowOrigins:
+      - "http://*.example.com"
+      - "http://foo.bar.com"
+      - "https://*"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-1"
+      - "x-header-2"
+      exposeHeaders:
+      - "x-header-3"
+      - "x-header-4"
+      maxAge: 1000s
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
new file mode 100755
index 000000000..d0fd54b1b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
@@ -0,0 +1,115 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-1
+    namespace: default
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-1
+      - x-header-2
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - http://*.example.com
+      - http://foo.bar.com
+      - https://*
+      exposeHeaders:
+      - x-header-3
+      - x-header-4
+      maxAge: 16m40s
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Namespace:default TargetRef.Namespace:envoy-gateway, SecurityPolicy
+          can only target a resource in the same namespace.
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.in.yaml
new file mode 100644
index 000000000..fff03a86c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.in.yaml
@@ -0,0 +1,23 @@
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-unknown-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: unknown-gateway
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-unknown-httproute
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: unknown-httproute
+      namespace: envoy-gateway
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.out.yaml
new file mode 100644
index 000000000..c05267109
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.out.yaml
@@ -0,0 +1,31 @@
+infraIR: {}
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-unknown-httproute
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: unknown-httproute
+      namespace: envoy-gateway
+  status:
+    ancestors: null
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-unknown-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: unknown-gateway
+      namespace: envoy-gateway
+  status:
+    ancestors: null
+xdsIR: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.in.yaml
new file mode 100644
index 000000000..c5afd9fe8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.in.yaml
@@ -0,0 +1,117 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/bar"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    cors:
+      allowOrigins:
+      - "http://*.example.com"
+      - "http://foo.bar.com"
+      - "https://*"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-1"
+      - "x-header-2"
+      exposeHeaders:
+      - "x-header-3"
+      - "x-header-4"
+      maxAge: 1000s
+    jwt:
+      providers:
+      - name: example1
+        issuer: https://one.example.com
+        audiences:
+        - one.foo.com
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key
+          claim: claim1
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    cors:
+      allowOrigins:
+      - "https://*.test.com:8080"
+      - "https://www.test.org:8080"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-5"
+      - "x-header-6"
+      exposeHeaders:
+      - "x-header-7"
+      - "x-header-8"
+      maxAge: 2000s
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.out.yaml
new file mode 100755
index 000000000..3008e7c8a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.out.yaml
@@ -0,0 +1,338 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-1
+    namespace: default
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-5
+      - x-header-6
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - https://*.test.com:8080
+      - https://www.test.org:8080
+      exposeHeaders:
+      - x-header-7
+      - x-header-8
+      maxAge: 33m20s
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-1
+    namespace: envoy-gateway
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-1
+      - x-header-2
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - http://*.example.com
+      - http://foo.bar.com
+      - https://*
+      exposeHeaders:
+      - x-header-3
+      - x-header-4
+      maxAge: 16m40s
+    jwt:
+      providers:
+      - audiences:
+        - one.foo.com
+        claimToHeaders:
+        - claim: claim1
+          header: one-route-example-key
+        issuer: https://one.example.com
+        name: example1
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        cors:
+          allowHeaders:
+          - x-header-5
+          - x-header-6
+          allowMethods:
+          - GET
+          - POST
+          allowOrigins:
+          - distinct: false
+            name: ""
+            safeRegex: https://.*\.test\.com:8080
+          - distinct: false
+            exact: https://www.test.org:8080
+            name: ""
+          exposeHeaders:
+          - x-header-7
+          - x-header-8
+          maxAge: 33m20s
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        cors:
+          allowHeaders:
+          - x-header-1
+          - x-header-2
+          allowMethods:
+          - GET
+          - POST
+          allowOrigins:
+          - distinct: false
+            name: ""
+            safeRegex: http://.*\.example\.com
+          - distinct: false
+            exact: http://foo.bar.com
+            name: ""
+          - distinct: false
+            name: ""
+            safeRegex: https://.*
+          exposeHeaders:
+          - x-header-3
+          - x-header-4
+          maxAge: 16m40s
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        jwt:
+          providers:
+          - audiences:
+            - one.foo.com
+            claimToHeaders:
+            - claim: claim1
+              header: one-route-example-key
+            issuer: https://one.example.com
+            name: example1
+            remoteJWKS:
+              uri: https://one.example.com/jwt/public-key/jwks.json
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.in.yaml
new file mode 100644
index 000000000..6600b040c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.in.yaml
@@ -0,0 +1,133 @@
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1-as-well
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-httproute-in-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: also-target-httproute-in-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-grpcroute-in-gateway-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: envoy-gateway
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: envoy-gateway
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+    rules:
+    - matches:
+      - headers:
+        - type: Exact
+          name: magic
+          value: foo
+      backendRefs:
+      - name: service-1
+        port: 8080
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      protocol: HTTPS
+      port: 443
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: tcp
+      protocol: TCP
+      port: 53
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.out.yaml
new file mode 100755
index 000000000..2ddeae68c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.out.yaml
@@ -0,0 +1,436 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: https
+      port: 443
+      protocol: HTTPS
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: tcp
+      port: 53
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must have TLS set when protocol is HTTPS.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: https
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: magic
+          type: Exact
+          value: foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-2/tcp
+        ports:
+        - containerPort: 10053
+          name: tcp
+          protocol: TCP
+          servicePort: 53
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-httproute-in-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: also-target-httproute-in-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Unable to target HTTPRoute, another SecurityPolicy has already attached
+          to it
+        reason: Conflicted
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-grpcroute-in-gateway-2
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [envoy-gateway/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1-as-well
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Unable to target Gateway, another SecurityPolicy has already attached
+          to it
+        reason: Conflicted
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        headerMatches:
+        - distinct: false
+          exact: foo
+          name: magic
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/envoy-gateway/grpcroute-1/rule/0/match/0/*
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.in.yaml
new file mode 100644
index 000000000..675503369
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.in.yaml
@@ -0,0 +1,58 @@
+secrets:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: default
+    name: users-secret
+  data:
+    .htpasswd: "dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo="
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    basicAuth:
+      users:
+        name: "users-secret"
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.out.yaml
new file mode 100644
index 000000000..493d550bd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.out.yaml
@@ -0,0 +1,166 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    basicAuth:
+      users:
+        group: null
+        kind: null
+        name: users-secret
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        basicAuth:
+          users: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.in.yaml
new file mode 100644
index 000000000..a39e1ec9c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.in.yaml
@@ -0,0 +1,173 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-3
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-3
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-2
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    cors:
+      allowOrigins:
+      - "http://*.example.com"
+      - "http://foo.bar.com"
+      - "https://*"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-1"
+      - "x-header-2"
+      exposeHeaders:
+      - "x-header-3"
+      - "x-header-4"
+      maxAge: 1000s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    cors:
+      allowOrigins:
+      - "https://*.test.com:8080"
+      - "https://www.test.org:8080"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-5"
+      - "x-header-6"
+      exposeHeaders:
+      - "x-header-7"
+      - "x-header-8"
+      maxAge: 2000s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+    cors:
+      allowOrigins:
+      - "*"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-5"
+      - "x-header-6"
+      exposeHeaders:
+      - "x-header-7"
+      - "x-header-8"
+      maxAge: 2000s
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.out.yaml
new file mode 100644
index 000000000..141420829
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.out.yaml
@@ -0,0 +1,554 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-3
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-3
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-3
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+  envoy-gateway/gateway-3:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-3/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-3
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-3
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-1
+    namespace: default
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-5
+      - x-header-6
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - https://*.test.com:8080
+      - https://www.test.org:8080
+      exposeHeaders:
+      - x-header-7
+      - x-header-8
+      maxAge: 33m20s
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-2
+    namespace: default
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-5
+      - x-header-6
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - '*'
+      exposeHeaders:
+      - x-header-7
+      - x-header-8
+      maxAge: 33m20s
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-3
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-1
+    namespace: envoy-gateway
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-1
+      - x-header-2
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - http://*.example.com
+      - http://foo.bar.com
+      - https://*
+      exposeHeaders:
+      - x-header-3
+      - x-header-4
+      maxAge: 16m40s
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        cors:
+          allowHeaders:
+          - x-header-1
+          - x-header-2
+          allowMethods:
+          - GET
+          - POST
+          allowOrigins:
+          - distinct: false
+            name: ""
+            safeRegex: http://.*\.example\.com
+          - distinct: false
+            exact: http://foo.bar.com
+            name: ""
+          - distinct: false
+            name: ""
+            safeRegex: https://.*
+          exposeHeaders:
+          - x-header-3
+          - x-header-4
+          maxAge: 16m40s
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        cors:
+          allowHeaders:
+          - x-header-5
+          - x-header-6
+          allowMethods:
+          - GET
+          - POST
+          allowOrigins:
+          - distinct: false
+            name: ""
+            safeRegex: https://.*\.test\.com:8080
+          - distinct: false
+            exact: https://www.test.org:8080
+            name: ""
+          exposeHeaders:
+          - x-header-7
+          - x-header-8
+          maxAge: 33m20s
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+  envoy-gateway/gateway-3:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-3/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        cors:
+          allowHeaders:
+          - x-header-5
+          - x-header-6
+          allowMethods:
+          - GET
+          - POST
+          allowOrigins:
+          - distinct: false
+            name: ""
+            safeRegex: .*
+          exposeHeaders:
+          - x-header-7
+          - x-header-8
+          maxAge: 33m20s
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml
new file mode 100644
index 000000000..246d99635
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml
@@ -0,0 +1,65 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: default
+      name: http-backend
+    spec:
+      ports:
+        - port: 8080
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            name: http-backend
+            namespace: default
+            port: 80
+          headersToBackend:
+            - header1
+            - header2
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
new file mode 100644
index 000000000..986994f0e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
@@ -0,0 +1,167 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: default
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: TCP Port 80 not found on service default/http-backend
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml
new file mode 100644
index 000000000..1ad4755a3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml
@@ -0,0 +1,64 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: default
+      name: http-backend
+    spec:
+      ports:
+        - port: 8080
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            name: http-backend
+            namespace: default
+          headersToBackend:
+            - header1
+            - header2
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
new file mode 100755
index 000000000..9a12785e4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
@@ -0,0 +1,167 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: default
+        headersToBackend:
+        - header1
+        - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: A valid port number corresponding to a port on the Service must be
+          specified
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml
new file mode 100644
index 000000000..8701ab075
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml
@@ -0,0 +1,65 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: envoy-gateway
+      name: http-backend
+    spec:
+      ports:
+        - port: 80
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            name: http-backend
+            namespace: envoy-gateway
+            port: 80
+          headersToBackend:
+            - header1
+            - header2
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
new file mode 100644
index 000000000..fab5b9930
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
@@ -0,0 +1,168 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: envoy-gateway
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Backend ref to Service envoy-gateway/http-backend not permitted by
+          any ReferenceGrant
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml
new file mode 100644
index 000000000..8834c8606
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            name: http-backend
+            namespace: default
+            port: 80
+          headersToBackend:
+            - header1
+            - header2
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
new file mode 100644
index 000000000..34585ba90
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
@@ -0,0 +1,167 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: default
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Service default/http-backend not found
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml
new file mode 100644
index 000000000..0102d9c6b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml
@@ -0,0 +1,231 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-2
+    spec:
+      hostnames:
+        - www.bar.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /bar
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: envoy-gateway
+      name: http-backend
+    spec:
+      ports:
+        - port: 80
+          name: http
+          protocol: TCP
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: default
+      name: grpc-backend
+    spec:
+      ports:
+        - port: 9000
+          name: grpc
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: envoy-gateway
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 80
+    endpoints:
+      - addresses:
+          - 7.7.7.7
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-grpc-backend
+      namespace: default
+      labels:
+        kubernetes.io/service-name: grpc-backend
+    addressType: IPv4
+    ports:
+      - name: grpc
+        protocol: TCP
+        port: 9000
+    endpoints:
+      - addresses:
+          - 8.8.8.8
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: envoy-gateway
+      name: referencegrant-1
+    spec:
+      from:
+        - group: apk.wso2.com
+          kind: SecurityPolicy
+          namespace: default
+        - group: gateway.networking.k8s.io
+          kind: BackendTLSPolicy
+          namespace: default
+      to:
+        - group: ''
+          kind: Service
+configMaps:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: ca-cmap
+      namespace: default
+    data:
+      ca.crt: |
+        -----BEGIN CERTIFICATE-----
+        MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
+        BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
+        MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
+        A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
+        1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
+        yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
+        kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
+        Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
+        ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
+        bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
+        6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
+        BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
+        2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
+        i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
+        A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
+        d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
+        3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
+        -----END CERTIFICATE-----
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls-http
+      namespace: default
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        namespace: envoy-gateway
+        sectionName: "80"
+      tls:
+        caCertRefs:
+          - name: ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: http-backend
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls-grpc
+      namespace: default
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: grpc-backend
+        sectionName: "9000"
+      tls:
+        caCertRefs:
+          - name: ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: grpc-backend
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            Name: http-backend
+            Namespace: envoy-gateway
+            Port: 80
+          Path: /auth
+          headersToBackend:
+            - header1
+            - header2
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-http-route
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+        namespace: default
+      extAuth:
+        headersToExtAuth:
+          - header1
+          - header2
+        grpc:
+          backendRef:
+            name: grpc-backend
+            port: 9000
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
new file mode 100755
index 000000000..ad044aac3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
@@ -0,0 +1,373 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls-http
+    namespace: default
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      namespace: envoy-gateway
+      sectionName: "80"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: http-backend
+  status:
+    ancestors:
+    - ancestorRef:
+        group: apk.wso2.com
+        kind: SecurityPolicy
+        name: policy-for-gateway
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: BackendTLSPolicy is Accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls-grpc
+    namespace: default
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: grpc-backend
+      sectionName: "9000"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: grpc-backend
+  status:
+    ancestors:
+    - ancestorRef:
+        group: apk.wso2.com
+        kind: SecurityPolicy
+        name: policy-for-http-route
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: BackendTLSPolicy is Accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - www.bar.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    extAuth:
+      grpc:
+        backendRef:
+          name: grpc-backend
+          port: 9000
+      headersToExtAuth:
+      - header1
+      - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: envoy-gateway
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+        path: /auth
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extAuth:
+          grpc:
+            authority: grpc-backend.default:9000
+            destination:
+              name: securitypolicy/default/policy-for-http-route/grpc-backend
+              settings:
+              - addressType: IP
+                endpoints:
+                - host: 8.8.8.8
+                  port: 9000
+                protocol: GRPC
+                tls:
+                  caCertificate:
+                    certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                    name: policy-btls-grpc/default-ca
+                  sni: grpc-backend
+                weight: 1
+          headersToExtAuth:
+          - header1
+          - header2
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extAuth:
+          http:
+            authority: http-backend.envoy-gateway:80
+            destination:
+              name: securitypolicy/default/policy-for-gateway/http-backend
+              settings:
+              - addressType: IP
+                endpoints:
+                - host: 7.7.7.7
+                  port: 80
+                protocol: HTTP
+                tls:
+                  caCertificate:
+                    certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                    name: policy-btls-http/default-ca
+                  sni: http-backend
+                weight: 1
+            headersToBackend:
+            - header1
+            - header2
+            path: /auth
+        hostname: www.bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.in.yaml
new file mode 100644
index 000000000..2521c1298
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.in.yaml
@@ -0,0 +1,165 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-2
+    spec:
+      hostnames:
+        - www.bar.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /bar
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: envoy-gateway
+      name: http-backend
+    spec:
+      ports:
+        - port: 80
+          name: http
+          protocol: TCP
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: default
+      name: grpc-backend
+    spec:
+      ports:
+        - port: 9000
+          name: grpc
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: envoy-gateway
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 80
+    endpoints:
+      - addresses:
+          - 7.7.7.7
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-grpc-backend
+      namespace: default
+      labels:
+        kubernetes.io/service-name: grpc-backend
+    addressType: IPv4
+    ports:
+      - name: grpc
+        protocol: TCP
+        port: 9000
+    endpoints:
+      - addresses:
+          - 8.8.8.8
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: envoy-gateway
+      name: referencegrant-1
+    spec:
+      from:
+        - group: apk.wso2.com
+          kind: SecurityPolicy
+          namespace: default
+      to:
+        - group: ''
+          kind: Service
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            Name: http-backend
+            Namespace: envoy-gateway
+            Port: 80
+          Path: /auth
+          headersToBackend:
+            - header1
+            - header2
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-http-route
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+        namespace: default
+      extAuth:
+        headersToExtAuth:
+          - header1
+          - header2
+        grpc:
+          backendRef:
+            name: grpc-backend
+            port: 9000
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.out.yaml
new file mode 100644
index 000000000..06400a32a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.out.yaml
@@ -0,0 +1,297 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - www.bar.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    extAuth:
+      grpc:
+        backendRef:
+          name: grpc-backend
+          port: 9000
+      headersToExtAuth:
+      - header1
+      - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: envoy-gateway
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+        path: /auth
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extAuth:
+          grpc:
+            authority: grpc-backend.default:9000
+            destination:
+              name: securitypolicy/default/policy-for-http-route/grpc-backend
+              settings:
+              - addressType: IP
+                endpoints:
+                - host: 8.8.8.8
+                  port: 9000
+                protocol: GRPC
+                weight: 1
+          headersToExtAuth:
+          - header1
+          - header2
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extAuth:
+          http:
+            authority: http-backend.envoy-gateway:80
+            destination:
+              name: securitypolicy/default/policy-for-gateway/http-backend
+              settings:
+              - addressType: IP
+                endpoints:
+                - host: 7.7.7.7
+                  port: 80
+                protocol: HTTP
+                weight: 1
+            headersToBackend:
+            - header1
+            - header2
+            path: /auth
+        hostname: www.bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.in.yaml
new file mode 100644
index 000000000..8e3d04dea
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.in.yaml
@@ -0,0 +1,111 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/bar"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway  # This policy should attach httproute-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jwt:
+      providers:
+      - name: example1
+        issuer: https://one.example.com
+        audiences:
+        - one.foo.com
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key
+          claim: claim1
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        name: "client1-secret"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route  # This policy should attach httproute-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+    jwt:
+      providers:
+      - name: example2
+        issuer: https://two.example.com
+        audiences:
+        - two.foo.com
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key
+          claim: claim2
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        name: "client2-secret"
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
new file mode 100644
index 000000000..d3c939f3b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
@@ -0,0 +1,308 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - two.foo.com
+        claimToHeaders:
+        - claim: claim2
+          header: one-route-example-key
+        issuer: https://two.example.com
+        name: example2
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client2-secret
+      provider:
+        issuer: https://accounts.google.com
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Secret default/client2-secret does not exist
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - one.foo.com
+        claimToHeaders:
+        - claim: claim1
+          header: one-route-example-key
+        issuer: https://one.example.com
+        name: example1
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client1-secret
+      provider:
+        issuer: https://accounts.google.com
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Secret envoy-gateway/client1-secret does not exist
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-2]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        jwt:
+          providers:
+          - audiences:
+            - one.foo.com
+            claimToHeaders:
+            - claim: claim1
+              header: one-route-example-key
+            issuer: https://one.example.com
+            name: example1
+            remoteJWKS:
+              uri: https://one.example.com/jwt/public-key/jwks.json
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        jwt:
+          providers:
+          - audiences:
+            - two.foo.com
+            claimToHeaders:
+            - claim: claim2
+              header: one-route-example-key
+            issuer: https://two.example.com
+            name: example2
+            remoteJWKS:
+              uri: https://one.example.com/jwt/public-key/jwks.json
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.in.yaml
new file mode 100644
index 000000000..7c3a41a1f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.in.yaml
@@ -0,0 +1,126 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jwt:
+      providers:
+      - name: example1
+        issuer: https://one.example.com
+        audiences:
+        - one.foo.com
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key
+          claim: claim1
+      - name: example2
+        issuer: https://two.example.com
+        audiences:
+        - two.foo.com
+        remoteJWKS:
+          uri: https://two.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: two-route-example-key
+          claim: claim2
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    jwt:
+      providers:
+      - name: example3
+        issuer: https://three.example.com
+        audiences:
+        - three.foo.com
+        remoteJWKS:
+          uri: https://three.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: three-route-example-key
+          claim: claim3
+        extractFrom:
+          headers:
+          - name: Authorization
+            valuePrefix: 'Bearer '
+          cookies:
+          - session_access_token
+          params:
+          - token
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
new file mode 100644
index 000000000..22f29d9c9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
@@ -0,0 +1,382 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - three.foo.com
+        claimToHeaders:
+        - claim: claim3
+          header: three-route-example-key
+        extractFrom:
+          cookies:
+          - session_access_token
+          headers:
+          - name: Authorization
+            valuePrefix: 'Bearer '
+          params:
+          - token
+        issuer: https://three.example.com
+        name: example3
+        remoteJWKS:
+          uri: https://three.example.com/jwt/public-key/jwks.json
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - one.foo.com
+        claimToHeaders:
+        - claim: claim1
+          header: one-route-example-key
+        issuer: https://one.example.com
+        name: example1
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+      - audiences:
+        - two.foo.com
+        claimToHeaders:
+        - claim: claim2
+          header: two-route-example-key
+        issuer: https://two.example.com
+        name: example2
+        remoteJWKS:
+          uri: https://two.example.com/jwt/public-key/jwks.json
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        jwt:
+          providers:
+          - audiences:
+            - one.foo.com
+            claimToHeaders:
+            - claim: claim1
+              header: one-route-example-key
+            issuer: https://one.example.com
+            name: example1
+            remoteJWKS:
+              uri: https://one.example.com/jwt/public-key/jwks.json
+          - audiences:
+            - two.foo.com
+            claimToHeaders:
+            - claim: claim2
+              header: two-route-example-key
+            issuer: https://two.example.com
+            name: example2
+            remoteJWKS:
+              uri: https://two.example.com/jwt/public-key/jwks.json
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        jwt:
+          providers:
+          - audiences:
+            - three.foo.com
+            claimToHeaders:
+            - claim: claim3
+              header: three-route-example-key
+            extractFrom:
+              cookies:
+              - session_access_token
+              headers:
+              - name: Authorization
+                valuePrefix: 'Bearer '
+              params:
+              - token
+            issuer: https://three.example.com
+            name: example3
+            remoteJWKS:
+              uri: https://three.example.com/jwt/public-key/jwks.json
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.in.yaml
new file mode 100644
index 000000000..0f57a7f98
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.in.yaml
@@ -0,0 +1,118 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jwt:
+      providers:
+      - name: example1
+        issuer: https://one.example.com
+        audiences:
+        - one.foo.com
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key
+          claim: claim1
+      - name: example2
+        issuer: http://two.example.com
+        audiences:
+        - two.foo.com
+        remoteJWKS:
+          uri: http://two.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: two-route-example-key
+          claim: claim2
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    jwt:
+      providers:
+      - name: example3
+        issuer: https://three.example.com
+        audiences:
+        - three.foo.com
+        remoteJWKS:
+          uri: https://three.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: three-route-example-key
+          claim: claim3
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.out.yaml
new file mode 100644
index 000000000..52ac328af
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.out.yaml
@@ -0,0 +1,366 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - three.foo.com
+        claimToHeaders:
+        - claim: claim3
+          header: three-route-example-key
+        issuer: https://three.example.com
+        name: example3
+        remoteJWKS:
+          uri: https://three.example.com/jwt/public-key/jwks.json
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - one.foo.com
+        claimToHeaders:
+        - claim: claim1
+          header: one-route-example-key
+        issuer: https://one.example.com
+        name: example1
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+      - audiences:
+        - two.foo.com
+        claimToHeaders:
+        - claim: claim2
+          header: two-route-example-key
+        issuer: http://two.example.com
+        name: example2
+        remoteJWKS:
+          uri: http://two.example.com/jwt/public-key/jwks.json
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        jwt:
+          providers:
+          - audiences:
+            - one.foo.com
+            claimToHeaders:
+            - claim: claim1
+              header: one-route-example-key
+            issuer: https://one.example.com
+            name: example1
+            remoteJWKS:
+              uri: https://one.example.com/jwt/public-key/jwks.json
+          - audiences:
+            - two.foo.com
+            claimToHeaders:
+            - claim: claim2
+              header: two-route-example-key
+            issuer: http://two.example.com
+            name: example2
+            remoteJWKS:
+              uri: http://two.example.com/jwt/public-key/jwks.json
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        jwt:
+          providers:
+          - audiences:
+            - three.foo.com
+            claimToHeaders:
+            - claim: claim3
+              header: three-route-example-key
+            issuer: https://three.example.com
+            name: example3
+            remoteJWKS:
+              uri: https://three.example.com/jwt/public-key/jwks.json
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.in.yaml
new file mode 100644
index 000000000..5c3795d80
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.in.yaml
@@ -0,0 +1,41 @@
+secrets:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: default
+    name: client1-secret
+  data:
+    client-secret: Y2xpZW50MTpzZWNyZXQK
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-non-exist-secretRef
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+    oidc:
+      provider:
+        issuer: "https://httpbin.org/"
+      clientID: "client1.apps.foo.bar.com"
+      clientSecret:
+        name: "client1-secret"
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
new file mode 100644
index 000000000..34cc81c21
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
@@ -0,0 +1,108 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-non-exist-secretRef
+    namespace: default
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    oidc:
+      clientID: client1.apps.foo.bar.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client1-secret
+      provider:
+        issuer: https://httpbin.org/
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: 'Error fetching endpoints from issuer: invalid character ''<'' looking
+          for beginning of value'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.in.yaml
new file mode 100644
index 000000000..0f291acfd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.in.yaml
@@ -0,0 +1,118 @@
+secrets:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: envoy-gateway
+    name: client2-secret
+  data:
+    client-secret: Y2xpZW50MTpzZWNyZXQK
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: default
+    name: client3-secret
+  data:
+    invalid_client_secret_key: Y2xpZW50MTpzZWNyZXQK
+
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-3
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-non-exist-secretRef
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+        authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth"
+        tokenEndpoint: "https://oauth2.googleapis.com/token"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        name: "client1-secret"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-no-referenceGrant
+    uid: 08335a80-83ba-4592-888f-6ac0bba44ce4
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+        authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth"
+        tokenEndpoint: "https://oauth2.googleapis.com/token"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        namespace: envoy-gateway
+        name: "client2-secret"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-no-client-secret-key
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-3
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+        authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth"
+        tokenEndpoint: "https://oauth2.googleapis.com/token"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        namespace: default
+        name: "client3-secret"
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
new file mode 100644
index 000000000..75516da5b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
@@ -0,0 +1,320 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-3
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+  default/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-2
+  default/gateway-3:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-3/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-3
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-3
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-non-exist-secretRef
+    namespace: default
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client1-secret
+      provider:
+        authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
+        issuer: https://accounts.google.com
+        tokenEndpoint: https://oauth2.googleapis.com/token
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Secret default/client1-secret does not exist
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-no-referenceGrant
+    namespace: default
+    uid: 08335a80-83ba-4592-888f-6ac0bba44ce4
+  spec:
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client2-secret
+        namespace: envoy-gateway
+      provider:
+        authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
+        issuer: https://accounts.google.com
+        tokenEndpoint: https://oauth2.googleapis.com/token
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Secret ref namespace must be unspecified/empty or default
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-no-client-secret-key
+    namespace: default
+  spec:
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client3-secret
+        namespace: default
+      provider:
+        authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
+        issuer: https://accounts.google.com
+        tokenEndpoint: https://oauth2.googleapis.com/token
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-3
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-3
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Client secret not found in secret default/client3-secret
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+  default/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+  default/gateway-3:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-3/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.in.yaml
new file mode 100644
index 000000000..8be22f023
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.in.yaml
@@ -0,0 +1,127 @@
+secrets:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: envoy-gateway
+    name: client1-secret
+  data:
+    client-secret: Y2xpZW50MTpzZWNyZXQK
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: default
+    name: client2-secret
+  data:
+    client-secret: Y2xpZW50MTpzZWNyZXQK
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: default
+    name: client3-secret
+  data:
+    client-secret: Y2xpZW50MTpzZWNyZXQK
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: apk
+    name: envoy-oidc-hmac
+  data:
+    hmac-secret: qrOYACHXoe7UEDI/raOjNSx+Z9ufXSc/22C3T6X/zPY=
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - www.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - www.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/bar"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway-discover-endpoints  # This policy should attach httproute-2
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        name: "client1-secret"
+      redirectURL: "https://www.example.com/bar/oauth2/callback"
+      logoutPath: "/bar/logout"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route   # This policy should attach httproute-1
+    uid: 08335a80-83ba-4592-888f-6ac0bba44ce4
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    oidc:
+      provider:
+        issuer: "https://oauth.foo.com"
+        authorizationEndpoint: "https://oauth.foo.com/oauth2/v2/auth"
+        tokenEndpoint: "https://oauth.foo.com/token"
+      clientID: "client2.oauth.foo.com"
+      clientSecret:
+        name: "client2-secret"
+      scopes: ["openid", "email", "profile"]
+      redirectURL: "https://www.example.com/foo/oauth2/callback"
+      logoutPath: "/foo/logout"
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.out.yaml
new file mode 100644
index 000000000..a6014fbff
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.out.yaml
@@ -0,0 +1,304 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - www.example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+    uid: 08335a80-83ba-4592-888f-6ac0bba44ce4
+  spec:
+    oidc:
+      clientID: client2.oauth.foo.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client2-secret
+      logoutPath: /foo/logout
+      provider:
+        authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+        issuer: https://oauth.foo.com
+        tokenEndpoint: https://oauth.foo.com/token
+      redirectURL: https://www.example.com/foo/oauth2/callback
+      scopes:
+      - openid
+      - email
+      - profile
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-discover-endpoints
+    namespace: envoy-gateway
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client1-secret
+      logoutPath: /bar/logout
+      provider:
+        issuer: https://accounts.google.com
+      redirectURL: https://www.example.com/bar/oauth2/callback
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.example.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_example_com
+        oidc:
+          clientID: client2.oauth.foo.com
+          clientSecret: Y2xpZW50MTpzZWNyZXQK
+          cookieSuffix: 5f93c2e4
+          hmacSecret: qrOYACHXoe7UEDI/raOjNSx+Z9ufXSc/22C3T6X/zPY=
+          logoutPath: /foo/logout
+          provider:
+            authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+            tokenEndpoint: https://oauth.foo.com/token
+          redirectPath: /foo/oauth2/callback
+          redirectURL: https://www.example.com/foo/oauth2/callback
+          scopes:
+          - openid
+          - email
+          - profile
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.example.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/www_example_com
+        oidc:
+          clientID: client1.apps.googleusercontent.com
+          clientSecret: Y2xpZW50MTpzZWNyZXQK
+          cookieSuffix: b0a1b740
+          hmacSecret: qrOYACHXoe7UEDI/raOjNSx+Z9ufXSc/22C3T6X/zPY=
+          logoutPath: /bar/logout
+          provider:
+            authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
+            tokenEndpoint: https://oauth2.googleapis.com/token
+          redirectPath: /bar/oauth2/callback
+          redirectURL: https://www.example.com/bar/oauth2/callback
+          scopes:
+          - openid
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.in.yaml b/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.in.yaml
new file mode 100644
index 000000000..b4beac9da
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.in.yaml
@@ -0,0 +1,46 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: TLS
+          port: 90
+          tls:
+            certificateRefs:
+              - group: ""
+                kind: Secret
+                name: tls-secret-1
+            mode: Terminate
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml b/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
new file mode 100644
index 000000000..b2246be98
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
@@ -0,0 +1,117 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 90
+      protocol: TLS
+      tls:
+        certificateRefs:
+        - group: ""
+          kind: Secret
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10090
+          name: tls
+          protocol: TLS
+          servicePort: 90
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tcproute-1
+      port: 10090
+      tls:
+        terminate:
+          certificates:
+          - name: envoy-gateway/tls-secret-1
+            privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+            serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/.gitignore b/adapter/internal/operator/gateway-api/testdata/tls/.gitignore
new file mode 100644
index 000000000..a813e7b2f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/.gitignore
@@ -0,0 +1,2 @@
+# allow test keys to be checked-in to test folder only
+!*.key
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256-cert.pem b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256-cert.pem
new file mode 100644
index 000000000..2ca528b49
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256-cert.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBgTCCASegAwIBAgIUFml8LBG0o/QK4Q+Z7k824sC2iFwwCgYIKoZIzj0EAwIw
+FjEUMBIGA1UEAwwLZm9vLmJhci5jb20wHhcNMjQwMjI5MDkzMDEwWhcNMzQwMjI2
+MDkzMDEwWjAWMRQwEgYDVQQDDAtmb28uYmFyLmNvbTBZMBMGByqGSM49AgEGCCqG
+SM49AwEHA0IABLaYvqKuVVoxDo52eWzvYB5jw7EMF86rmyoi5ZuayzdMvpg4zBr8
+RKBjNs+T1jB8OKucS/7RUDx0pz+976zM3iOjUzBRMB0GA1UdDgQWBBTO6+cg0R0d
+wtrzJQPG6g76hBBUzTAfBgNVHSMEGDAWgBTO6+cg0R0dwtrzJQPG6g76hBBUzTAP
+BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0gAMEUCIQC2XpPQgQzWae3b5pZt
+GcuMfDJ0c0OPKcnegkXZ2C4B3gIgU/sRkwIpLQNRV+EaYw4P5T5gPE6Y+VpmC98h
+oVjZ/zQ=
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256.key b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256.key
new file mode 100644
index 000000000..b5678c1fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256.key
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIAyfKQvPBudXRh0LLmtVRJPYl6e+GgzvgctFexKh9a1GoAoGCCqGSM49
+AwEHoUQDQgAEtpi+oq5VWjEOjnZ5bO9gHmPDsQwXzqubKiLlm5rLN0y+mDjMGvxE
+oGM2z5PWMHw4q5xL/tFQPHSnP73vrMzeIw==
+-----END EC PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384-cert.pem b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384-cert.pem
new file mode 100644
index 000000000..3d55a9124
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384-cert.pem
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBvTCCAUSgAwIBAgIUSivJGTDwokS7heY/2csRsz4vJB0wCgYIKoZIzj0EAwIw
+FjEUMBIGA1UEAwwLZm9vLmJhci5jb20wHhcNMjQwMjI5MDkzMDEwWhcNMzQwMjI2
+MDkzMDEwWjAWMRQwEgYDVQQDDAtmb28uYmFyLmNvbTB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABFvrvRebaaWuS6MAEId6wZfOKvuCTyUMOlZJqFCF9TkzMYl8CiofynOt
+Crs0vva9kd/P2JMGBJqgYevbwotrRi12qLnH04/joGIjjTOKo3Iofr+Fk8wLvAe3
+O1ZKtR9szqNTMFEwHQYDVR0OBBYEFIKs1QFnoDt9+qokR4ODWbMz1f+PMB8GA1Ud
+IwQYMBaAFIKs1QFnoDt9+qokR4ODWbMz1f+PMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDZwAwZAIwH31tHyfUP04XHpbWGe1Z1IaBZBwIth55DU4hjfPu8m+J
+Wv7bW8zTSgwLiqorfcunAjA0ghNJBA1X2XtIKDml3s7/Vx8FJcS04vpChh+lAbLS
+veaa28R3TLEY3U+QTXI/wIk=
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384.key b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384.key
new file mode 100644
index 000000000..4626890e6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384.key
@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDCeNj3chbP4g2cPOizPipLiJ6tCQAXf4rjSHHksQ1b6KV7xyDP6iVAK
+BVoyR/aipR+gBwYFK4EEACKhZANiAARb670Xm2mlrkujABCHesGXzir7gk8lDDpW
+SahQhfU5MzGJfAoqH8pzrQq7NL72vZHfz9iTBgSaoGHr28KLa0Ytdqi5x9OP46Bi
+I40ziqNyKH6/hZPMC7wHtztWSrUfbM4=
+-----END EC PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/gen-certs.sh b/adapter/internal/operator/gateway-api/testdata/tls/gen-certs.sh
new file mode 100755
index 000000000..8d428ed4a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/gen-certs.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+# The following commands were used to generate test key/cert pairs
+# using openssl (LibreSSL 3.3.6)
+
+CERT_VALIDITY_DAYS=3650
+
+# RSA
+
+openssl req -x509 -nodes -days $CERT_VALIDITY_DAYS -newkey rsa:2048 -keyout rsa-pkcs8.key -out rsa-cert.pem -subj "/CN=foo.bar.com"
+openssl rsa -in rsa-pkcs8.key -out rsa-pkcs1.key
+
+# RSA with SAN extension
+
+openssl req -x509 -nodes -days $CERT_VALIDITY_DAYS -newkey rsa:2048 -keyout rsa-pkcs8-san.key -out rsa-cert-san.pem -subj "/CN=Test Inc" -addext "subjectAltName = DNS:foo.bar.com"
+openssl rsa -in rsa-pkcs8-san.key -out rsa-pkcs1-san.key
+
+# RSA with wildcard SAN domain
+
+openssl req -x509 -nodes -days $CERT_VALIDITY_DAYS -newkey rsa:2048 -keyout rsa-pkcs8-wildcard.key -out rsa-cert-wildcard.pem -subj "/CN=Test Inc" -addext "subjectAltName = DNS:*, DNS:*.example.com"
+openssl rsa -in rsa-pkcs8-wildcard.key -out rsa-pkcs1-wildcard.key
+
+# ECDSA-p256
+
+openssl ecparam -name prime256v1 -genkey -noout -out ecdsa-p256.key
+openssl req -new -x509 -days $CERT_VALIDITY_DAYS -key ecdsa-p256.key -out ecdsa-p256-cert.pem -subj "/CN=foo.bar.com"
+
+# ECDSA-p384
+
+openssl ecparam -name secp384r1 -genkey -noout -out ecdsa-p384.key
+openssl req -new -x509 -days $CERT_VALIDITY_DAYS -key ecdsa-p384.key -out ecdsa-p384-cert.pem -subj "/CN=foo.bar.com"
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/invalid-key-type.key b/adapter/internal/operator/gateway-api/testdata/tls/invalid-key-type.key
new file mode 100644
index 000000000..5d5aa4d36
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/invalid-key-type.key
@@ -0,0 +1,3 @@
+-----BEGIN FOO-----
+SGVsbG8gd29ybGQK
+-----END FOO-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/malformed-cert.pem b/adapter/internal/operator/gateway-api/testdata/tls/malformed-cert.pem
new file mode 100644
index 000000000..0c19932b1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/malformed-cert.pem
@@ -0,0 +1,3 @@
+-----BEGIN CERTIFICATE-----
+SGVsbG8gd29ybGQK
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/malformed-ecdsa.key b/adapter/internal/operator/gateway-api/testdata/tls/malformed-ecdsa.key
new file mode 100644
index 000000000..e6cc48732
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/malformed-ecdsa.key
@@ -0,0 +1,3 @@
+-----BEGIN EC PRIVATE KEY-----
+SGVsbG8gd29ybGQK
+-----END EC PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/malformed-encoding.pem b/adapter/internal/operator/gateway-api/testdata/tls/malformed-encoding.pem
new file mode 100644
index 000000000..9a02198b4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/malformed-encoding.pem
@@ -0,0 +1 @@
+SGVsbG8gd29ybGQK
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs1.key b/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs1.key
new file mode 100644
index 000000000..02ef0ad96
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs1.key
@@ -0,0 +1,3 @@
+-----BEGIN RSA PRIVATE KEY-----
+SGVsbG8gd29ybGQK
+-----END RSA PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs8.key b/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs8.key
new file mode 100644
index 000000000..18d998a6e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs8.key
@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+SGVsbG8gd29ybGQK
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-san.pem b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-san.pem
new file mode 100644
index 000000000..3dfef07bc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-san.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDHzCCAgegAwIBAgIUWL1B/R492wfVLSDYPTpACUMQTiMwDQYJKoZIhvcNAQEL
+BQAwEzERMA8GA1UEAwwIVGVzdCBJbmMwHhcNMjQwMjI5MDkzMDEwWhcNMzQwMjI2
+MDkzMDEwWjATMREwDwYDVQQDDAhUZXN0IEluYzCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMpoxyIyxqyqk/s1BCrUhbH0k+PyOGdb1sI5EazA/p9BpmSI
+zX99ViqFuha+gf1Q0Ght/Wh5Fy4UKzcgo4Jv3qd3r82q+M0VojAj7RBajiwsPSDV
+u6hNiy4CE9Ic2abqmh1HMlbQnaYafXkZoRhvCH3enZ1h2tfRprmwa+vYO3HlLk9k
+x2Z3xcXIaePNoBOe71U9t/gsKakjnIk7rV0S//BW6YYEYlHRxTbSeoyqsSC0ImL/
+gT+0dm/rmtU0e1LVUMGzQI/BFMqD/hUgSrweH0t7BjFOsIK2S62loQ87HQOx5ntV
+aPO4C8TAdxheUcCscoUQ233tsMo9qPy6paQTfgMCAwEAAaNrMGkwHQYDVR0OBBYE
+FLxFSbDoGbAEZAHoayV/xzIHMTu5MB8GA1UdIwQYMBaAFLxFSbDoGbAEZAHoayV/
+xzIHMTu5MA8GA1UdEwEB/wQFMAMBAf8wFgYDVR0RBA8wDYILZm9vLmJhci5jb20w
+DQYJKoZIhvcNAQELBQADggEBAJ6zTuAm5LPUv1A6Y6ASzRqepEfzHJb2AdBKQKG4
+oPqQlqbs2HyILGjGv//h8YU17LKV6W0fQ7bvUlHTiIdlh3mBL838r1cLGO2LaUf1
+JNhtKY+kT9I+KxV1ZPkrASLb2/6673bOyOdTU4D6OSPsywtvZ7qWM564hm2qw62G
+2SgiC4+F61/BkcvG3XRhhAcLpCxyyrzdAuXsnhOHHLziJZ9byLTceWoGnIPk8qA5
+yKpnsH2LPYPUeY1HxNTNTUc0+BQpjikqPmdSyYGi4EUwBEhMVYZBhJLjmaEL3Dee
+7zt7DFeERauy/uHL+LteokP0E7eKgAk+amoJxY+PYv2jMZk=
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-wildcard.pem b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-wildcard.pem
new file mode 100644
index 000000000..a4f1c00ce
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-wildcard.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDJDCCAgygAwIBAgIUSrSbKLf0bLEGogWx/gCw2GCtvxEwDQYJKoZIhvcNAQEL
+BQAwEzERMA8GA1UEAwwIVGVzdCBJbmMwHhcNMjQwMjI5MDkzMDEwWhcNMzQwMjI2
+MDkzMDEwWjATMREwDwYDVQQDDAhUZXN0IEluYzCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAK1JzjPIiWg3qoHSrAddkeJjaMP9iyMTi/BPo9cJPoRE8Zi7
+WapUrXL/9A9r+jHMyGIZNZNdcZ5cY2Xv0LP8ZxVy2lk0+3wtYzHnpGYGVtyq2tet
+DhFsiPl82YRjC0mzWa4QMz4SXzFHNgIDpRdhfrovmseuWGQE8pV4Ud9UK/SKilMO
+qtB5JirLP2Vs5T1oWicWLQvfbGwv7sFDdr9bG0XtSQp17HSgo50SDE5+BjSmptFw
+1VcKLlqahMXBDDiorgwhIhGGKpESeM0P7bFhVmkM3ash2xSTBuFUBDlE4JOahzws
+DXrupUhDdS1hdc2fPrjhFAlJfWEYZ6BlZjysiVUCAwEAAaNwMG4wHQYDVR0OBBYE
+FBQufK1LibuVm9Ts/VjBx8L3uiNeMB8GA1UdIwQYMBaAFBQufK1LibuVm9Ts/VjB
+x8L3uiNeMA8GA1UdEwEB/wQFMAMBAf8wGwYDVR0RBBQwEoIBKoINKi5leGFtcGxl
+LmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAfPS41agevWMV3ZXt0COFG3uYfPFXnVw6
+P41p9O6GkdYsuqFvPeTyyH2/dAIKKwSzM/pthg8Kn8LZlmJyFNnA1stJxn5XdbV1
+pPqj8UvYCBzyjMIqmRyoiyLiQlbohMa0UdEBKcH/PdLE9K8TGJrZgoGXqq1WmitD
+3vcPjSePKEiUJVS9lChySs0KY5B+hUQD0Jj6npFD4Zk0xqdxh0rWueCqq7vjqEYz
+pj4Pwrufn1PBTmfxMuV/UJV5ebikeuZP35kWzLR7ZWAL7wuDdWp/6o4yk3QLanDQ
+CwgCFcX+ss+0VyuM3YerTOUU8QVJJx4UZANZx6+43pdJZOcntPZ4CA==
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert.pem b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert.pem
new file mode 100644
index 000000000..84a712c48
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDDTCCAfWgAwIBAgIUEFMhP9eJ9XABWsQ5Zm6bRk2cLNQwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLZm9vLmJhci5jb20wHhcNMjQwMjI5MDkzMDEwWhcNMzQw
+MjI2MDkzMDEwWjAWMRQwEgYDVQQDDAtmb28uYmFyLmNvbTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAJlI6YxE9ZkCPs6pCQxbrCmeix9P5Dfx9Ru5LD4T
+JmdW7IKdtQV/wfLmtsu76B+aTdCjWe0BTfeOORBbR3cPAG6ElQLiclQUrun3q+gs
+JpK+I7cI+j5w8I68XH5WQ7rVUtbwHpqbw+cVnBqIUOLiIatjIf7KX51M1uF9cfEH
+E4DncH6rbr59/RFZBskhxs5OzwJIfohkyvFweuTwxK/VpjI+7Oc48ABCXpNO9D/q
+Eh+rOaujAMcXgHQITkCiiUTcUo6LSH9vLZPtaqfzoZq6nhMqpW65E1pAwF3jyTTx
+a5I8JcfSFjkieZ20LUQMn7M8U4xHjao/gvH0CAfdB7RLU2sCAwEAAaNTMFEwHQYD
+VR0OBBYEFORCE8u/1DDW7ihZp7cx9tSmPm6OMB8GA1UdIwQYMBaAFORCE8u/1DDW
+7ihZp7cx9tSmPm6OMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+AFt53zjsqTaH5a8E2chvmWAgCrxRK8bVLMxiwNGjbmEPRz+w6Nx+k0A8KEcIDsKc
+SXci58u4oWbtVJBlza/ZujHR6P1BnOpl+aoy784bbd4P39wTLoXfMfbBCm1vevh9
+AJKnw2Ztqr4mkbLcxEqlq3sBLFAS9sQLnKNCe2cGLdTp2boG+qcgyQgCIM6f8EMv
+WPifCMMGuzK/GRF4bPO/YF48ewDu3Ueih0XXdUAOE9CtUa8NIhc1UPaOzPrtYVqr
+ZOGkv/Ku+B78h8SEsO9XrQcuwbOnJx6KtR+aeykvApXCQ3fZC/bYKAAR+P8AJoQZ
+bwIUmXi4gj5m+bKPhe+ir+E=
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-san.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-san.key
new file mode 100644
index 000000000..4a103794b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-san.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDKaMciMsasqpP7
+NQQq1IWx9JPj8jhnW9bCORGswP6fQaZkiM1/fVYqhboWvoH9UNBobf1oeRcuFCs3
+IKOCb96nd6/NqvjNFaIwI+0QWo4sLD0g1buoTYsuAhPSHNmm6podRzJW0J2mGn15
+GaEYbwh93p2dYdrX0aa5sGvr2Dtx5S5PZMdmd8XFyGnjzaATnu9VPbf4LCmpI5yJ
+O61dEv/wVumGBGJR0cU20nqMqrEgtCJi/4E/tHZv65rVNHtS1VDBs0CPwRTKg/4V
+IEq8Hh9LewYxTrCCtkutpaEPOx0DseZ7VWjzuAvEwHcYXlHArHKFENt97bDKPaj8
+uqWkE34DAgMBAAECggEAOh5v32/5ACdSqnUEp0+yu/BgbrlkXLlQJyC/5HzeH9h3
+8LIfX5YbocYYMuOs65HC5dl/Q/pRH5gG+KNUj+WTZz7EqieHnUuy8GPAdEusOx7Q
+xpbYdXEen61VB6XlETqX2gRRfgAU5FcC5Dzpttxa8dl0JHauof2/A96WfnfuSbtk
+GlCLQdMg+pstPWq3rXeUQ09LFQdOCsZsUz76QzlxXo2YlCDcIQVprT0YlkZ5iIFM
+2HkFtaJGBW6bTNjiTyqSQTkz35AIk8mIZbuqjLZC65WKpwgbscVMxl5eRRuSQ06o
+BFnZYJDLeeDmD7yV2vFS14WNDnohPyw9dcAzRO614QKBgQDoSJ7InpRExuud2Cij
+36xMfwcXpmfh63EBDhmgw6L4EhJ25zKm1ZzKL+ULAzLos/Y3w69Rf1X6miHZ93Gk
+EjHFGKorY8TRegJny/uhUNqEc0KzB2BhSucXFGs6XTWM2qGXGRK2ecepJjTX7uy3
+Z2Pq/wD396BDb7gt+L71PSWD2QKBgQDfE064ojNLQ2yszXmL283TzI+Cadcs28GV
+f+5cV97QSEimSsgK9hrg7PzdcEk7jkAye1GgRldqEoH+9lrIH8ltTIkiw/F8lvkw
+3UM9XvR9MKPEGKuxxFo0I/ksxtaHcSALpkFQMgakC5386XgOiIcOaM7hib3hrWBx
+HKpZuq0TOwKBgAg3OVaDNV9RYdgNYzKYoLF79LZDbn0xJKgS5ZkoEkWP7hNCjioU
+eB02oHVJQa21X8oNI9BQHqxkczoQZHaXJieAfdRXDQkTta4SKu5Du9bfdMZ8Rk5q
+pc3NLRW9Yj1/JiQAAQdvOz6iWVAh5UF/aKtRJamfmo2IEA2gNLDb3s3RAoGAUcXq
+HZSX6QcWV2IbJEG2+eUK1mumDTOhiwQShJdRfliBCTRwkFQXFkzJhQMcVVCYB+lc
+yrv+X0vZi3UTYjkExaRAwRXC+ED/qAH0HBMq3Jlv7vp8NfYcevCU7u0UxyGY9axE
+VPmBpbD8gTG0aN9zYrzY2aR8jrXXnJ89cxcTSvECgYEAvtFZMBh+noQxMttnh0/L
+LwrAjedj8pWOAPzCdDFxvgzVp1mdi7GxbH4noEhcPhTlZ53Wfi3oOB4uhcGdXWpk
+HbjIWVUWczRKh15dICHNcbykU55T6p1jpPyYXsJfmonCWVYt9yppsLJ5wCu648J3
+QT4FZnPrtsI8mIcPI24A4xU=
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-wildcard.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-wildcard.key
new file mode 100644
index 000000000..4b212d5fa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-wildcard.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCtSc4zyIloN6qB
+0qwHXZHiY2jD/YsjE4vwT6PXCT6ERPGYu1mqVK1y//QPa/oxzMhiGTWTXXGeXGNl
+79Cz/GcVctpZNPt8LWMx56RmBlbcqtrXrQ4RbIj5fNmEYwtJs1muEDM+El8xRzYC
+A6UXYX66L5rHrlhkBPKVeFHfVCv0iopTDqrQeSYqyz9lbOU9aFonFi0L32xsL+7B
+Q3a/WxtF7UkKdex0oKOdEgxOfgY0pqbRcNVXCi5amoTFwQw4qK4MISIRhiqREnjN
+D+2xYVZpDN2rIdsUkwbhVAQ5ROCTmoc8LA167qVIQ3UtYXXNnz644RQJSX1hGGeg
+ZWY8rIlVAgMBAAECggEAJjN4jSreu8ZVxNPcD62dfPJcRKSOuTdUaLAt1rhXe1I1
+jm1yyV1sdUcelw2/NJ5H6HRVPrzhUL9ePDkfYaY5VV2h6/uFmyzoSrado84u9OuH
+Xfds/ANYuONAknJBKUir8vboTP1A1fy0V8JU8TARf1sCPJXfL4F1tuS0685C+F/6
+djrRq8ijw7wBgfptXeecVB1uqrKflKU4i86gCX6fC9KIa4YOHUUrR/d1epe1KujW
+5JZtbgIrsWT8Yk/m47R6Azk1UotZVxKbZyCYsQB9iTfLSXU9mIC7uPuYw9qwBiRo
+YR00BVI3BtUrcvoQtL3P7jWA/f0EHmOKCRLGOaNFkQKBgQDyB+MSSqbWhuwXVc2g
+RViOUqQtthqku+9kZce1O8NZTDjAoCP7K5TIs8RoZLnIS12r4V3X9B4NkkxDwBvj
+ngM1MBppNlKrRvGTLIqtsu9dsSzzNueZZLAtovIg4aEP2cBLmoc4XcDQiDdU/EjB
+TypTbDm40z9pBl3EBRXdFCxlaQKBgQC3SjejSRC3vAuA8QNeX2RyOB7qU5M/5EMJ
+FeNB3KNzper/b17bgumhG8XE+fw9OhyWg8kipHbicddO3UsNYF6wOpTf5XUmPhJJ
+rxX3ibB3imjuMnrBBc9oEQYrHYe7e8hqb8e8tsrl23t1zNTYfEAV/mgGGvSKLkb+
+x4zkfDTrDQKBgQDhw1Ggoln2Cmz3Z2Yjdgwg1h2nNhKsT1ICyJ39A/44sczOgZKO
+nBxxCp7O8gYKO6LozZQH+QJ/jlPtbqmVLLO5TWGVesKqWcbFjereE+cL8lUHmdN3
+VmCwcSqCWXUvn+Kroz026t0Mp8NVVu9Wwk2s+2rsaMDharrUOhom2sZ+4QKBgQCp
+QYDlaShl8uFQnb91m3NfQlHSI4E7o+b/cdXdUQkjV1kNrmOTI23pF4NmpU53n70c
+hO/s7KDX9TZVHmcbIB3wcPhfVT38JZ+vqV4Iq35otUi2hajzrBDeUbI3iFp6GBF3
+sGdq7gWpgyecHZ2DmCF57edTk/qzy45F4jJKICSh1QKBgDoHRNBc84OghC3mnpkq
+h/dERHHhseCqFa79Z/47hGM02YOhm8PdkIFBubwGZYO8slx+OLFmg9hdf1vahJBg
+G36uNic5VarCL4x3RsMiZCwmokP9AR52D/vvnxR47jbP/x+4B2qc6fwJVAQNhFg0
+KtOqp0kWe61o2COcNV/PVxj3
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1.key
new file mode 100644
index 000000000..d07adaf01
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEugIBADANBgkqhkiG9w0BAQEFAASCBKQwggSgAgEAAoIBAQCZSOmMRPWZAj7O
+qQkMW6wpnosfT+Q38fUbuSw+EyZnVuyCnbUFf8Hy5rbLu+gfmk3Qo1ntAU33jjkQ
+W0d3DwBuhJUC4nJUFK7p96voLCaSviO3CPo+cPCOvFx+VkO61VLW8B6am8PnFZwa
+iFDi4iGrYyH+yl+dTNbhfXHxBxOA53B+q26+ff0RWQbJIcbOTs8CSH6IZMrxcHrk
+8MSv1aYyPuznOPAAQl6TTvQ/6hIfqzmrowDHF4B0CE5AoolE3FKOi0h/by2T7Wqn
+86Gaup4TKqVuuRNaQMBd48k08WuSPCXH0hY5InmdtC1EDJ+zPFOMR42qP4Lx9AgH
+3Qe0S1NrAgMBAAECgf96g/PYxvaZy4Bn1NrJBd8LZOgcbZc2gnx6Ikv/UXZ0Nhlx
+EYiKjeFjV6HW5oEXrZ+/mPf4dusVaL74U9VojuPJceAeRrjL3eOhbHtcx+0gcGLg
+XxF9TRap65TuUd1ai04hGwYf75sbP7RKbPivwZgUAe0CpVufchnXqrsYr8pJY51O
+WVkSqz4RY9Wm0k5G1JFyIyEC9umDlujcHNtRVmafkNfAtCliPrFKc/n9nJfO6RFP
+7g7V/IvqnuIr7PE3Gn6PaT+Bgg448td5JzPpTA5ZBcBo2orz/kxYPFpr/gPUBqQd
+o6nWqw76ZxwPldwLhJ+XYNX7ouctUSCL9u77fyECgYEAyv7Dlxf+KQlfDwmo/r1T
+0L1ZnH472hiIedSheyVBHbEVTSmr42BRljW4DbRcQM4VcxxDkGrR76RGe9og6mzc
+Rv8+VlCX2+qy9p5m6ZXrbAw30zC/5mPkRWubhUhi+9eCMZa/hAI/RFv269DrBD2/
+6kg0F8X0O/6wI+WpatK3W0cCgYEAwU9A6bJpfaXKKXPGmOG/nUxTyzyqYjKNZJd/
+9GhEnuGjK5CAEVPJa8kZvfQzlWmwZafq0DhqI8vLaFCDf8Y8E99Man3GWhUb3V/J
+qNQQS356NCfZw7lxoKKBIvT6cwihTnsE/R4HCsal2wwN4Zl9HWNBgamS7TLkz1Lh
+fwRDkL0CgYBZ49j+5nwA9gpnIVL5gyNDcyXke63LVUPSF0tuub+NA2a4ZbSdGoDm
+cGFRiEW12Mx8zc5JfFP8t5USsTQUOyKMOekD1ep5UwPu25Qc6et3TC3IUnUX87IY
+357dtYFHnlYj2WpzbX9QqRy9riT0GtgKSfDvehQ+IPkk3EVabXcObwKBgGGxC70O
+zQESp/gK6nKYo5161V4Aapr1sT8E0UVS7Fre7Pc3L4GSNliiaL/2iZsYrmyxT5mq
+6PjuJP2yssIADJx+XL/0kCk2Qb6+icsoYJPGdzukaAjhzuq/NUPVSjyYP+zJftvs
+MOLhQTBSBzHbv776SkCc0gPNlJSx7gOixAKBAoGAJBGUn3e5AfComA1E1DxRyLZj
+T0PkACePjD+xkFJhwDhCgswhm4UJg1fAo1hBQRFttpVC/uBLck18MEAI1vdfSyPv
+kSg5kVqPju3sg39TMgOVewjP3E3AMQGug1P71Yk2zYJPlh95dLU5HJVno6ovB+Pm
+Lqy+Mzx3wkF0d8ePXQ4=
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-san.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-san.key
new file mode 100644
index 000000000..4a103794b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-san.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDKaMciMsasqpP7
+NQQq1IWx9JPj8jhnW9bCORGswP6fQaZkiM1/fVYqhboWvoH9UNBobf1oeRcuFCs3
+IKOCb96nd6/NqvjNFaIwI+0QWo4sLD0g1buoTYsuAhPSHNmm6podRzJW0J2mGn15
+GaEYbwh93p2dYdrX0aa5sGvr2Dtx5S5PZMdmd8XFyGnjzaATnu9VPbf4LCmpI5yJ
+O61dEv/wVumGBGJR0cU20nqMqrEgtCJi/4E/tHZv65rVNHtS1VDBs0CPwRTKg/4V
+IEq8Hh9LewYxTrCCtkutpaEPOx0DseZ7VWjzuAvEwHcYXlHArHKFENt97bDKPaj8
+uqWkE34DAgMBAAECggEAOh5v32/5ACdSqnUEp0+yu/BgbrlkXLlQJyC/5HzeH9h3
+8LIfX5YbocYYMuOs65HC5dl/Q/pRH5gG+KNUj+WTZz7EqieHnUuy8GPAdEusOx7Q
+xpbYdXEen61VB6XlETqX2gRRfgAU5FcC5Dzpttxa8dl0JHauof2/A96WfnfuSbtk
+GlCLQdMg+pstPWq3rXeUQ09LFQdOCsZsUz76QzlxXo2YlCDcIQVprT0YlkZ5iIFM
+2HkFtaJGBW6bTNjiTyqSQTkz35AIk8mIZbuqjLZC65WKpwgbscVMxl5eRRuSQ06o
+BFnZYJDLeeDmD7yV2vFS14WNDnohPyw9dcAzRO614QKBgQDoSJ7InpRExuud2Cij
+36xMfwcXpmfh63EBDhmgw6L4EhJ25zKm1ZzKL+ULAzLos/Y3w69Rf1X6miHZ93Gk
+EjHFGKorY8TRegJny/uhUNqEc0KzB2BhSucXFGs6XTWM2qGXGRK2ecepJjTX7uy3
+Z2Pq/wD396BDb7gt+L71PSWD2QKBgQDfE064ojNLQ2yszXmL283TzI+Cadcs28GV
+f+5cV97QSEimSsgK9hrg7PzdcEk7jkAye1GgRldqEoH+9lrIH8ltTIkiw/F8lvkw
+3UM9XvR9MKPEGKuxxFo0I/ksxtaHcSALpkFQMgakC5386XgOiIcOaM7hib3hrWBx
+HKpZuq0TOwKBgAg3OVaDNV9RYdgNYzKYoLF79LZDbn0xJKgS5ZkoEkWP7hNCjioU
+eB02oHVJQa21X8oNI9BQHqxkczoQZHaXJieAfdRXDQkTta4SKu5Du9bfdMZ8Rk5q
+pc3NLRW9Yj1/JiQAAQdvOz6iWVAh5UF/aKtRJamfmo2IEA2gNLDb3s3RAoGAUcXq
+HZSX6QcWV2IbJEG2+eUK1mumDTOhiwQShJdRfliBCTRwkFQXFkzJhQMcVVCYB+lc
+yrv+X0vZi3UTYjkExaRAwRXC+ED/qAH0HBMq3Jlv7vp8NfYcevCU7u0UxyGY9axE
+VPmBpbD8gTG0aN9zYrzY2aR8jrXXnJ89cxcTSvECgYEAvtFZMBh+noQxMttnh0/L
+LwrAjedj8pWOAPzCdDFxvgzVp1mdi7GxbH4noEhcPhTlZ53Wfi3oOB4uhcGdXWpk
+HbjIWVUWczRKh15dICHNcbykU55T6p1jpPyYXsJfmonCWVYt9yppsLJ5wCu648J3
+QT4FZnPrtsI8mIcPI24A4xU=
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-wildcard.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-wildcard.key
new file mode 100644
index 000000000..4b212d5fa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-wildcard.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCtSc4zyIloN6qB
+0qwHXZHiY2jD/YsjE4vwT6PXCT6ERPGYu1mqVK1y//QPa/oxzMhiGTWTXXGeXGNl
+79Cz/GcVctpZNPt8LWMx56RmBlbcqtrXrQ4RbIj5fNmEYwtJs1muEDM+El8xRzYC
+A6UXYX66L5rHrlhkBPKVeFHfVCv0iopTDqrQeSYqyz9lbOU9aFonFi0L32xsL+7B
+Q3a/WxtF7UkKdex0oKOdEgxOfgY0pqbRcNVXCi5amoTFwQw4qK4MISIRhiqREnjN
+D+2xYVZpDN2rIdsUkwbhVAQ5ROCTmoc8LA167qVIQ3UtYXXNnz644RQJSX1hGGeg
+ZWY8rIlVAgMBAAECggEAJjN4jSreu8ZVxNPcD62dfPJcRKSOuTdUaLAt1rhXe1I1
+jm1yyV1sdUcelw2/NJ5H6HRVPrzhUL9ePDkfYaY5VV2h6/uFmyzoSrado84u9OuH
+Xfds/ANYuONAknJBKUir8vboTP1A1fy0V8JU8TARf1sCPJXfL4F1tuS0685C+F/6
+djrRq8ijw7wBgfptXeecVB1uqrKflKU4i86gCX6fC9KIa4YOHUUrR/d1epe1KujW
+5JZtbgIrsWT8Yk/m47R6Azk1UotZVxKbZyCYsQB9iTfLSXU9mIC7uPuYw9qwBiRo
+YR00BVI3BtUrcvoQtL3P7jWA/f0EHmOKCRLGOaNFkQKBgQDyB+MSSqbWhuwXVc2g
+RViOUqQtthqku+9kZce1O8NZTDjAoCP7K5TIs8RoZLnIS12r4V3X9B4NkkxDwBvj
+ngM1MBppNlKrRvGTLIqtsu9dsSzzNueZZLAtovIg4aEP2cBLmoc4XcDQiDdU/EjB
+TypTbDm40z9pBl3EBRXdFCxlaQKBgQC3SjejSRC3vAuA8QNeX2RyOB7qU5M/5EMJ
+FeNB3KNzper/b17bgumhG8XE+fw9OhyWg8kipHbicddO3UsNYF6wOpTf5XUmPhJJ
+rxX3ibB3imjuMnrBBc9oEQYrHYe7e8hqb8e8tsrl23t1zNTYfEAV/mgGGvSKLkb+
+x4zkfDTrDQKBgQDhw1Ggoln2Cmz3Z2Yjdgwg1h2nNhKsT1ICyJ39A/44sczOgZKO
+nBxxCp7O8gYKO6LozZQH+QJ/jlPtbqmVLLO5TWGVesKqWcbFjereE+cL8lUHmdN3
+VmCwcSqCWXUvn+Kroz026t0Mp8NVVu9Wwk2s+2rsaMDharrUOhom2sZ+4QKBgQCp
+QYDlaShl8uFQnb91m3NfQlHSI4E7o+b/cdXdUQkjV1kNrmOTI23pF4NmpU53n70c
+hO/s7KDX9TZVHmcbIB3wcPhfVT38JZ+vqV4Iq35otUi2hajzrBDeUbI3iFp6GBF3
+sGdq7gWpgyecHZ2DmCF57edTk/qzy45F4jJKICSh1QKBgDoHRNBc84OghC3mnpkq
+h/dERHHhseCqFa79Z/47hGM02YOhm8PdkIFBubwGZYO8slx+OLFmg9hdf1vahJBg
+G36uNic5VarCL4x3RsMiZCwmokP9AR52D/vvnxR47jbP/x+4B2qc6fwJVAQNhFg0
+KtOqp0kWe61o2COcNV/PVxj3
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8.key
new file mode 100644
index 000000000..d07adaf01
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEugIBADANBgkqhkiG9w0BAQEFAASCBKQwggSgAgEAAoIBAQCZSOmMRPWZAj7O
+qQkMW6wpnosfT+Q38fUbuSw+EyZnVuyCnbUFf8Hy5rbLu+gfmk3Qo1ntAU33jjkQ
+W0d3DwBuhJUC4nJUFK7p96voLCaSviO3CPo+cPCOvFx+VkO61VLW8B6am8PnFZwa
+iFDi4iGrYyH+yl+dTNbhfXHxBxOA53B+q26+ff0RWQbJIcbOTs8CSH6IZMrxcHrk
+8MSv1aYyPuznOPAAQl6TTvQ/6hIfqzmrowDHF4B0CE5AoolE3FKOi0h/by2T7Wqn
+86Gaup4TKqVuuRNaQMBd48k08WuSPCXH0hY5InmdtC1EDJ+zPFOMR42qP4Lx9AgH
+3Qe0S1NrAgMBAAECgf96g/PYxvaZy4Bn1NrJBd8LZOgcbZc2gnx6Ikv/UXZ0Nhlx
+EYiKjeFjV6HW5oEXrZ+/mPf4dusVaL74U9VojuPJceAeRrjL3eOhbHtcx+0gcGLg
+XxF9TRap65TuUd1ai04hGwYf75sbP7RKbPivwZgUAe0CpVufchnXqrsYr8pJY51O
+WVkSqz4RY9Wm0k5G1JFyIyEC9umDlujcHNtRVmafkNfAtCliPrFKc/n9nJfO6RFP
+7g7V/IvqnuIr7PE3Gn6PaT+Bgg448td5JzPpTA5ZBcBo2orz/kxYPFpr/gPUBqQd
+o6nWqw76ZxwPldwLhJ+XYNX7ouctUSCL9u77fyECgYEAyv7Dlxf+KQlfDwmo/r1T
+0L1ZnH472hiIedSheyVBHbEVTSmr42BRljW4DbRcQM4VcxxDkGrR76RGe9og6mzc
+Rv8+VlCX2+qy9p5m6ZXrbAw30zC/5mPkRWubhUhi+9eCMZa/hAI/RFv269DrBD2/
+6kg0F8X0O/6wI+WpatK3W0cCgYEAwU9A6bJpfaXKKXPGmOG/nUxTyzyqYjKNZJd/
+9GhEnuGjK5CAEVPJa8kZvfQzlWmwZafq0DhqI8vLaFCDf8Y8E99Man3GWhUb3V/J
+qNQQS356NCfZw7lxoKKBIvT6cwihTnsE/R4HCsal2wwN4Zl9HWNBgamS7TLkz1Lh
+fwRDkL0CgYBZ49j+5nwA9gpnIVL5gyNDcyXke63LVUPSF0tuub+NA2a4ZbSdGoDm
+cGFRiEW12Mx8zc5JfFP8t5USsTQUOyKMOekD1ep5UwPu25Qc6et3TC3IUnUX87IY
+357dtYFHnlYj2WpzbX9QqRy9riT0GtgKSfDvehQ+IPkk3EVabXcObwKBgGGxC70O
+zQESp/gK6nKYo5161V4Aapr1sT8E0UVS7Fre7Pc3L4GSNliiaL/2iZsYrmyxT5mq
+6PjuJP2yssIADJx+XL/0kCk2Qb6+icsoYJPGdzukaAjhzuq/NUPVSjyYP+zJftvs
+MOLhQTBSBzHbv776SkCc0gPNlJSx7gOixAKBAoGAJBGUn3e5AfComA1E1DxRyLZj
+T0PkACePjD+xkFJhwDhCgswhm4UJg1fAo1hBQRFttpVC/uBLck18MEAI1vdfSyPv
+kSg5kVqPju3sg39TMgOVewjP3E3AMQGug1P71Yk2zYJPlh95dLU5HJVno6ovB+Pm
+Lqy+Mzx3wkF0d8ePXQ4=
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.in.yaml
new file mode 100644
index 000000000..a10119662
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.in.yaml
@@ -0,0 +1,32 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: TLS
+          hostname: foo.com
+          port: 90
+          tls:
+            mode: Passthrough
+          allowedRoutes:
+            namespaces:
+              from: All
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.out.yaml
new file mode 100644
index 000000000..95aec2678
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.out.yaml
@@ -0,0 +1,112 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls
+      port: 90
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10090
+          name: tls
+          protocol: TLS
+          servicePort: 90
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-1
+      port: 10090
+      tls:
+        passthrough:
+          snis:
+          - foo.com
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.in.yaml
new file mode 100644
index 000000000..e7d44bece
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: tls
+      protocol: TLS
+      port: 91
+      tls:
+        mode: Passthrough
+      allowedRoutes:
+        namespaces:
+          from: All
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    namespace: default
+    name: tlsroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - "foo.com"
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    namespace: default
+    name: tlsroute-2
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - "bar.com"
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.out.yaml
new file mode 100644
index 000000000..6cd2d930b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.out.yaml
@@ -0,0 +1,162 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 91
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10091
+          name: tls
+          protocol: TLS
+          servicePort: 91
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    hostnames:
+    - foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-2
+    namespace: default
+  spec:
+    hostnames:
+    - bar.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-1
+      port: 10091
+      tls:
+        passthrough:
+          snis:
+          - foo.com
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-2/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-2
+      port: 10091
+      tls:
+        passthrough:
+          snis:
+          - bar.com
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.in.yaml
new file mode 100644
index 000000000..f37773dbd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: TLS
+          port: 90
+          allowedRoutes:
+            namespaces:
+              from: All
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
new file mode 100644
index 000000000..a75fdbe5e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
@@ -0,0 +1,81 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 90
+      protocol: TLS
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must have TLS set when protocol is TLS.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
new file mode 100644
index 000000000..00e85a873
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
@@ -0,0 +1,78 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: TLS
+          hostname: foo.com
+          port: 90
+          tls:
+            mode: Passthrough
+          allowedRoutes:
+            namespaces:
+              from: All
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              namespace: test-service-namespace
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: test-service-namespace
+      name: service-1
+    spec:
+      clusterIP: 1.1.1.1
+      ports:
+        - name: http
+          port: 8080
+          protocol: TCP
+          targetPort: 8080
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-service-1
+      namespace: test-service-namespace
+      labels:
+        kubernetes.io/service-name: service-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "7.7.7.7"
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: test-service-namespace
+      name: referencegrant-1
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: TLSRoute
+          namespace: default
+      to:
+        - group: ""
+          kind: Service
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
new file mode 100644
index 000000000..e62a5aab0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -0,0 +1,113 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls
+      port: 90
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10090
+          name: tls
+          protocol: TLS
+          servicePort: 90
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        namespace: test-service-namespace
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-1
+      port: 10090
+      tls:
+        passthrough:
+          snis:
+          - foo.com
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.in.yaml
new file mode 100644
index 000000000..76f60b075
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.in.yaml
@@ -0,0 +1,31 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: tls
+      protocol: TLS
+      port: 91
+      tls:
+        mode: Passthrough
+      allowedRoutes:
+        namespaces:
+          from: All
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    namespace: default
+    name: tlsroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.out.yaml
new file mode 100644
index 000000000..919955fee
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.out.yaml
@@ -0,0 +1,111 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 91
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10091
+          name: tls
+          protocol: TLS
+          servicePort: 91
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-1
+      port: 10091
+      tls:
+        passthrough:
+          snis:
+          - '*'
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.in.yaml
new file mode 100644
index 000000000..621f046a9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: tls
+      protocol: TLS
+      port: 91
+      tls:
+        mode: Passthrough
+      allowedRoutes:
+        namespaces:
+          from: All
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    namespace: default
+    name: tlsroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - "foo.com"
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.out.yaml
new file mode 100644
index 000000000..f3ef27913
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.out.yaml
@@ -0,0 +1,113 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 91
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10091
+          name: tls
+          protocol: TLS
+          servicePort: 91
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    hostnames:
+    - foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-1
+      port: 10091
+      tls:
+        passthrough:
+          snis:
+          - foo.com
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.in.yaml
new file mode 100644
index 000000000..26a91e256
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.in.yaml
@@ -0,0 +1,44 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: TLS
+          hostname: foo.com
+          tls:
+            mode: Passthrough
+            certificateRefs:
+              - name: tls-secret-1
+          port: 90
+          allowedRoutes:
+            namespaces:
+              from: All
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: Zm9vCg==
+      tls.key: YmFyCg==
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
new file mode 100644
index 000000000..92b48bfca
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
@@ -0,0 +1,86 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls
+      port: 90
+      protocol: TLS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must not have TLS certificate refs set for TLS mode Passthrough.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/tls.go b/adapter/internal/operator/gateway-api/tls.go
new file mode 100644
index 000000000..5cf277c97
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/tls.go
@@ -0,0 +1,149 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// validateTLSSecretData ensures the cert and key provided in a secret
+// is not malformed and can be properly parsed
+func validateTLSSecretsData(secrets []*corev1.Secret, host *v1.Hostname) error {
+	var publicKeyAlgorithm string
+	var parseErr error
+
+	pkaSecretSet := make(map[string][]string)
+	for _, secret := range secrets {
+		certData := secret.Data[corev1.TLSCertKey]
+
+		if err := validateCertificate(certData); err != nil {
+			return fmt.Errorf("%s/%s must contain valid %s and %s, unable to validate certificate in %s: %w", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSCertKey, err)
+		}
+
+		certBlock, _ := pem.Decode(certData)
+		if certBlock == nil {
+			return fmt.Errorf("%s/%s must contain valid %s and %s, unable to decode pem data in %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSCertKey)
+		}
+
+		cert, err := x509.ParseCertificate(certBlock.Bytes)
+		if err != nil {
+			return fmt.Errorf("%s/%s must contain valid %s and %s, unable to parse certificate in %s: %w", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSCertKey, err)
+		}
+		publicKeyAlgorithm = cert.PublicKeyAlgorithm.String()
+
+		keyData := secret.Data[corev1.TLSPrivateKeyKey]
+
+		keyBlock, _ := pem.Decode(keyData)
+		if keyBlock == nil {
+			return fmt.Errorf("%s/%s must contain valid %s and %s, unable to decode pem data in %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSPrivateKeyKey)
+		}
+
+		matchedFQDN, err := verifyHostname(cert, host)
+		if err != nil {
+			return fmt.Errorf("%s/%s must contain valid %s and %s, hostname %s does not match Common Name or DNS Names in the certificate %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, string(*host), corev1.TLSCertKey)
+		}
+		pkaSecretKey := fmt.Sprintf("%s/%s", publicKeyAlgorithm, matchedFQDN)
+
+		// Check whether the public key algorithm and matched certificate FQDN in the referenced secrets are unique.
+		if matchedFQDN, ok := pkaSecretSet[pkaSecretKey]; ok {
+			return fmt.Errorf("%s/%s public key algorithm must be unique, matched certificate FQDN %s has a conflicting algorithm [%s]",
+				secret.Namespace, secret.Name, matchedFQDN, publicKeyAlgorithm)
+
+		}
+		pkaSecretSet[pkaSecretKey] = matchedFQDN
+
+		switch keyBlock.Type {
+		case "PRIVATE KEY":
+			_, err := x509.ParsePKCS8PrivateKey(keyBlock.Bytes)
+			if err != nil {
+				parseErr = fmt.Errorf("%s/%s must contain valid %s and %s, unable to parse PKCS8 formatted private key in %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSPrivateKeyKey)
+			}
+		case "RSA PRIVATE KEY":
+			_, err := x509.ParsePKCS1PrivateKey(keyBlock.Bytes)
+			if err != nil {
+				parseErr = fmt.Errorf("%s/%s must contain valid %s and %s, unable to parse PKCS1 formatted private key in %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSPrivateKeyKey)
+			}
+		case "EC PRIVATE KEY":
+			_, err := x509.ParseECPrivateKey(keyBlock.Bytes)
+			if err != nil {
+				parseErr = fmt.Errorf("%s/%s must contain valid %s and %s, unable to parse EC formatted private key in %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSPrivateKeyKey)
+			}
+		default:
+			return fmt.Errorf("%s/%s must contain valid %s and %s, %s key format found in %s, supported formats are PKCS1, PKCS8 or EC", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, keyBlock.Type, corev1.TLSPrivateKeyKey)
+		}
+	}
+
+	return parseErr
+}
+
+// verifyHostname checks if the listener Hostname matches any domain in the certificate, returns a list of matched hosts.
+func verifyHostname(cert *x509.Certificate, host *v1.Hostname) ([]string, error) {
+	var matchedHosts []string
+
+	if len(cert.DNSNames) > 0 {
+		matchedHosts = computeHosts(cert.DNSNames, host)
+	} else {
+		matchedHosts = computeHosts([]string{cert.Subject.CommonName}, host)
+	}
+
+	if len(matchedHosts) > 0 {
+		return matchedHosts, nil
+	}
+
+	return nil, x509.HostnameError{Certificate: cert, Host: string(*host)}
+}
+
+func validateCertificate(data []byte) error {
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return fmt.Errorf("pem decode failed")
+	}
+	certs, err := x509.ParseCertificates(block.Bytes)
+	if err != nil {
+		return err
+	}
+	now := time.Now()
+	roundedTime := now.Truncate(time.Minute)
+
+	// TODO(amali) remove this round logic if any issue happens.
+	// it's added due to issue in gateway conformance test certificate
+	// Only add a minute if the current time is not exactly on the minute
+	if !now.Equal(roundedTime) {
+		roundedTime = roundedTime.Add(time.Minute)
+	}
+	for _, cert := range certs {
+		if roundedTime.After(cert.NotAfter) {
+			return fmt.Errorf("certificate is expired %v, now: %v", cert.NotAfter, roundedTime)
+		}
+		if roundedTime.Before(cert.NotBefore) {
+			return fmt.Errorf("certificate is not yet valid %v, now %v", cert.NotBefore, roundedTime)
+		}
+	}
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/tls_test.go b/adapter/internal/operator/gateway-api/tls_test.go
new file mode 100644
index 000000000..8faaef876
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/tls_test.go
@@ -0,0 +1,236 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+const (
+	secretName      = "secret"
+	secretNamespace = "test"
+)
+
+// createTestSecret creates a K8s tls secret using testdata
+// see for more info <https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets>
+func createTestSecrets(t *testing.T, certFile, keyFile string) []*corev1.Secret {
+	t.Helper()
+
+	certData, err := os.ReadFile(filepath.Join("testdata", "tls", certFile))
+	require.NoError(t, err)
+
+	keyData, err := os.ReadFile(filepath.Join("testdata", "tls", keyFile))
+	require.NoError(t, err)
+
+	return []*corev1.Secret{{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      secretName,
+			Namespace: secretNamespace,
+		},
+		Type: corev1.SecretTypeTLS,
+		Data: map[string][]byte{
+			corev1.TLSCertKey:       certData,
+			corev1.TLSPrivateKeyKey: keyData,
+		},
+	}}
+}
+
+// TestValidateTLSSecretData ensures that we can properly validate the contents of a K8s tls secret.
+// The test assumes the secret is valid and was able to be applied to a cluster.
+func TestValidateTLSSecretsData(t *testing.T) {
+	type testCase struct {
+		Name        string
+		CertFile    string
+		KeyFile     string
+		Domain      v1.Hostname
+		ExpectedErr error
+	}
+
+	testCases := []testCase{
+		{
+			Name:        "valid-rsa-pkcs1",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "rsa-pkcs1.key",
+			Domain:      "*",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-rsa-pkcs8",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "rsa-pkcs8.key",
+			Domain:      "*",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-rsa-san-domain",
+			CertFile:    "rsa-cert-san.pem",
+			KeyFile:     "rsa-pkcs8-san.key",
+			Domain:      "foo.bar.com",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-rsa-wildcard-domain",
+			CertFile:    "rsa-cert-wildcard.pem",
+			KeyFile:     "rsa-pkcs1-wildcard.key",
+			Domain:      "foo.bar.com",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-ecdsa-p256",
+			CertFile:    "ecdsa-p256-cert.pem",
+			KeyFile:     "ecdsa-p256.key",
+			Domain:      "*",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-ecdsa-p384",
+			CertFile:    "ecdsa-p384-cert.pem",
+			KeyFile:     "ecdsa-p384.key",
+			Domain:      "*",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "malformed-cert-pem-encoding",
+			CertFile:    "malformed-encoding.pem",
+			KeyFile:     "rsa-pkcs8.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to validate certificate in tls.crt: pem decode failed"),
+		},
+		{
+			Name:        "malformed-key-pem-encoding",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "malformed-encoding.pem",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to decode pem data in tls.key"),
+		},
+		{
+			Name:        "malformed-cert",
+			CertFile:    "malformed-cert.pem",
+			KeyFile:     "rsa-pkcs8.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to validate certificate in tls.crt: x509: malformed certificate"),
+		},
+		{
+			Name:        "malformed-pkcs8-key",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "malformed-pkcs8.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to parse PKCS8 formatted private key in tls.key"),
+		},
+		{
+			Name:        "malformed-pkcs1-key",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "malformed-pkcs1.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to parse PKCS1 formatted private key in tls.key"),
+		},
+		{
+			Name:        "malformed-ecdsa-key",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "malformed-ecdsa.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to parse EC formatted private key in tls.key"),
+		},
+		{
+			Name:        "invalid-key-type",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "invalid-key-type.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, FOO key format found in tls.key, supported formats are PKCS1, PKCS8 or EC"),
+		},
+		{
+			Name:        "invalid-domain-cert",
+			CertFile:    "rsa-cert-san.pem",
+			KeyFile:     "rsa-pkcs8-san.key",
+			Domain:      "*.example.com",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, hostname *.example.com does not match Common Name or DNS Names in the certificate tls.crt"),
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.Name, func(t *testing.T) {
+			secrets := createTestSecrets(t, tc.CertFile, tc.KeyFile)
+			require.NotNil(t, secrets)
+			err := validateTLSSecretsData(secrets, &tc.Domain)
+			if tc.ExpectedErr == nil {
+				require.NoError(t, err)
+			} else {
+				require.EqualError(t, err, tc.ExpectedErr.Error())
+			}
+		})
+	}
+}
+
+func TestValidateCertificate(t *testing.T) {
+	type testCase struct {
+		Name        string
+		CertFile    string
+		ExpectedErr error
+	}
+
+	testCases := []testCase{
+		{
+			Name:        "valid-rsa-cert",
+			CertFile:    "rsa-cert.pem",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-ecdsa-p256-cert",
+			CertFile:    "ecdsa-p256-cert.pem",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-ecdsa-p384-cert",
+			CertFile:    "ecdsa-p384-cert.pem",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "malformed-cert",
+			CertFile:    "malformed-cert.pem",
+			ExpectedErr: errors.New("x509: malformed certificate"),
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.Name, func(t *testing.T) {
+			certData, err := os.ReadFile(filepath.Join("testdata", "tls", tc.CertFile))
+			require.NoError(t, err)
+			err = validateCertificate(certData)
+			if tc.ExpectedErr == nil {
+				require.NoError(t, err)
+			} else {
+				require.EqualError(t, err, tc.ExpectedErr.Error())
+			}
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/translator.go b/adapter/internal/operator/gateway-api/translator.go
new file mode 100644
index 000000000..90b54a421
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator.go
@@ -0,0 +1,292 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"golang.org/x/exp/maps"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+const (
+	KindConfigMap        = "ConfigMap"
+	KindBackendTLSPolicy = "BackendTLSPolicy"
+	KindGateway          = "Gateway"
+	KindGatewayClass     = "GatewayClass"
+	KindGRPCRoute        = "GRPCRoute"
+	KindHTTPRoute        = "HTTPRoute"
+	KindNamespace        = "Namespace"
+	KindTLSRoute         = "TLSRoute"
+	KindTCPRoute         = "TCPRoute"
+	KindUDPRoute         = "UDPRoute"
+	KindService          = "Service"
+	KindServiceImport    = "ServiceImport"
+	KindSecret           = "Secret"
+	KindBackend          = "Backend"
+
+	GroupMultiClusterService = "multicluster.x-k8s.io"
+	// OwningGatewayNamespaceLabel is the owner reference label used for managed infra.
+	// The value should be the namespace of the accepted Envoy Gateway.
+	OwningGatewayNamespaceLabel = "apk.wso2.com/owning-gateway-namespace"
+
+	OwningGatewayClassLabel = "apk.wso2.com/owning-gatewayclass"
+	// OwningGatewayNameLabel is the owner reference label used for managed infra.
+	// The value should be the name of the accepted Envoy Gateway.
+	OwningGatewayNameLabel = "apk.wso2.com/owning-gateway-name"
+
+	// minEphemeralPort is the first port in the ephemeral port range.
+	minEphemeralPort = 1024
+	// wellKnownPortShift is the constant added to the well known port (1-1023)
+	// to convert it into an ephemeral port.
+	wellKnownPortShift = 10000
+)
+
+var _ TranslatorManager = (*Translator)(nil)
+
+type TranslatorManager interface {
+	Translate(resources *Resources) *TranslateResult
+	GetRelevantGateways(gateways []*gwapiv1.Gateway) []*GatewayContext
+
+	RoutesTranslator
+	ListenersTranslator
+	AddressesTranslator
+	FiltersTranslator
+}
+
+// Translator translates Gateway API resources to IRs and computes status
+// for Gateway API resources.
+type Translator struct {
+	// GatewayControllerName is the name of the Gateway API controller
+	GatewayControllerName string
+
+	// GatewayClassName is the name of the GatewayClass
+	// to process Gateways for.
+	GatewayClassName gwapiv1.ObjectName
+
+	// GlobalRateLimitEnabled is true when global
+	// ratelimiting has been configured by the admin.
+	GlobalRateLimitEnabled bool
+
+	// EndpointRoutingDisabled can be set to true to use
+	// the Service Cluster IP for routing to the backend
+	// instead.
+	EndpointRoutingDisabled bool
+
+	// MergeGateways is true when all Gateway Listeners
+	// should be merged under the parent GatewayClass.
+	MergeGateways bool
+
+	// EnvoyPatchPolicyEnabled when the EnvoyPatchPolicy
+	// feature is enabled.
+	EnvoyPatchPolicyEnabled bool
+
+	// ExtensionGroupKinds stores the group/kind for all resources
+	// introduced by an Extension so that the translator can
+	// store referenced resources in the IR for later use.
+	ExtensionGroupKinds []schema.GroupKind
+
+	// Namespace is the namespace that Envoy Gateway runs in.
+	Namespace string
+}
+
+type TranslateResult struct {
+	Resources
+	XdsIR   XdsIRMap   `json:"xdsIR" yaml:"xdsIR"`
+	InfraIR InfraIRMap `json:"infraIR" yaml:"infraIR"`
+}
+
+func newTranslateResult(gateways []*GatewayContext,
+	httpRoutes []*HTTPRouteContext,
+	grpcRoutes []*GRPCRouteContext,
+	tlsRoutes []*TLSRouteContext,
+	tcpRoutes []*TCPRouteContext,
+	udpRoutes []*UDPRouteContext,
+	xdsIR XdsIRMap, infraIR InfraIRMap) *TranslateResult {
+	translateResult := &TranslateResult{
+		XdsIR:   xdsIR,
+		InfraIR: infraIR,
+	}
+
+	for _, gateway := range gateways {
+		translateResult.Gateways = append(translateResult.Gateways, gateway.Gateway)
+	}
+	for _, httpRoute := range httpRoutes {
+		translateResult.HTTPRoutes = append(translateResult.HTTPRoutes, httpRoute.HTTPRoute)
+	}
+	for _, grpcRoute := range grpcRoutes {
+		translateResult.GRPCRoutes = append(translateResult.GRPCRoutes, grpcRoute.GRPCRoute)
+	}
+	for _, tlsRoute := range tlsRoutes {
+		translateResult.TLSRoutes = append(translateResult.TLSRoutes, tlsRoute.TLSRoute)
+	}
+	for _, tcpRoute := range tcpRoutes {
+		translateResult.TCPRoutes = append(translateResult.TCPRoutes, tcpRoute.TCPRoute)
+	}
+	for _, udpRoute := range udpRoutes {
+		translateResult.UDPRoutes = append(translateResult.UDPRoutes, udpRoute.UDPRoute)
+	}
+	return translateResult
+}
+
+func (t *Translator) Translate(resources *Resources) *TranslateResult {
+	// Get Gateways belonging to our GatewayClass.
+	gateways := t.GetRelevantGateways(resources.Gateways)
+
+	// Build IR maps.
+	xdsIR, infraIR := t.InitIRs(gateways, resources)
+
+	// Process all Listeners for all relevant Gateways.
+	t.ProcessListeners(gateways, xdsIR, infraIR, resources)
+
+	// Process all Addresses for all relevant Gateways.
+	t.ProcessAddresses(gateways, infraIR)
+
+	// Process all relevant HTTPRoutes.
+	httpRoutes := t.ProcessHTTPRoutes(resources.HTTPRoutes, gateways, resources, xdsIR)
+
+	// Process all relevant GRPCRoutes.
+	// grpcRoutes := t.ProcessGRPCRoutes(resources.GRPCRoutes, gateways, resources, xdsIR)
+
+	// // Process all relevant TLSRoutes.
+	// tlsRoutes := t.ProcessTLSRoutes(resources.TLSRoutes, gateways, resources, xdsIR)
+
+	// // Process all relevant TCPRoutes.
+	// tcpRoutes := t.ProcessTCPRoutes(resources.TCPRoutes, gateways, resources, xdsIR)
+
+	// // Process all relevant UDPRoutes.
+	// udpRoutes := t.ProcessUDPRoutes(resources.UDPRoutes, gateways, resources, xdsIR)
+
+	// Process BackendTrafficPolicies
+	// routes := []RouteContext{}
+	// for _, h := range httpRoutes {
+	// 	routes = append(routes, h)
+	// }
+	// for _, g := range grpcRoutes {
+	// 	routes = append(routes, g)
+	// }
+	// for _, t := range tlsRoutes {
+	// 	routes = append(routes, t)
+	// }
+	// for _, t := range tcpRoutes {
+	// 	routes = append(routes, t)
+	// }
+	// for _, u := range udpRoutes {
+	// 	routes = append(routes, u)
+	// }
+
+	// Process BackendTrafficPolicies
+	// backendTrafficPolicies := t.ProcessBackendTrafficPolicies(
+	// 	resources.BackendTrafficPolicies, gateways, routes, xdsIR)
+
+	// // Process SecurityPolicies
+	// securityPolicies := t.ProcessSecurityPolicies(
+	// 	resources.SecurityPolicies, gateways, routes, resources, xdsIR)
+
+	// Sort xdsIR based on the Gateway API spec
+	sortXdsIRMap(xdsIR)
+
+	return newTranslateResult(gateways, httpRoutes, nil, nil, nil, nil, xdsIR, infraIR)
+
+}
+
+// GetRelevantGateways returns GatewayContexts, containing a copy of the original
+// Gateway with the Listener statuses reset.
+func (t *Translator) GetRelevantGateways(gateways []*gwapiv1.Gateway) []*GatewayContext {
+	var relevant []*GatewayContext
+
+	for _, gateway := range gateways {
+		if gateway == nil {
+			panic("received nil gateway")
+		}
+
+		if gateway.Spec.GatewayClassName == t.GatewayClassName {
+			gc := &GatewayContext{
+				Gateway: gateway.DeepCopy(),
+			}
+			gc.ResetListeners()
+
+			relevant = append(relevant, gc)
+		}
+	}
+
+	return relevant
+}
+
+// InitIRs checks if mergeGateways is enabled in EnvoyProxy config and initializes XdsIR and InfraIR maps with adequate keys.
+func (t *Translator) InitIRs(gateways []*GatewayContext, resources *Resources) (map[string]*ir.Xds, map[string]*ir.Infra) {
+	xdsIR := make(XdsIRMap)
+	infraIR := make(InfraIRMap)
+
+	var irKey string
+	for _, gateway := range gateways {
+		gwXdsIR := &ir.Xds{}
+		gwInfraIR := ir.NewInfra()
+		labels := infrastructureLabels(gateway.Gateway)
+		annotations := infrastructureAnnotations(gateway.Gateway)
+		gwInfraIR.Proxy.GetProxyMetadata().Annotations = annotations
+
+		irKey = irStringKey(gateway.Gateway.Namespace, gateway.Gateway.Name)
+
+		maps.Copy(labels, GatewayOwnerLabels(gateway.Namespace, gateway.Name))
+		gwInfraIR.Proxy.GetProxyMetadata().Labels = labels
+
+		gwInfraIR.Proxy.Name = irKey
+		// save the IR references in the map before the translation starts
+		xdsIR[irKey] = gwXdsIR
+		infraIR[irKey] = gwInfraIR
+	}
+
+	return xdsIR, infraIR
+}
+
+func infrastructureAnnotations(gtw *gwapiv1.Gateway) map[string]string {
+	if gtw.Spec.Infrastructure != nil && len(gtw.Spec.Infrastructure.Annotations) > 0 {
+		res := make(map[string]string)
+		for k, v := range gtw.Spec.Infrastructure.Annotations {
+			res[string(k)] = string(v)
+		}
+		return res
+	}
+	return nil
+}
+
+func infrastructureLabels(gtw *gwapiv1.Gateway) map[string]string {
+	res := make(map[string]string)
+	if gtw.Spec.Infrastructure != nil {
+		for k, v := range gtw.Spec.Infrastructure.Labels {
+			res[string(k)] = string(v)
+		}
+	}
+	return res
+}
+
+// XdsIR and InfraIR map keys by default are {GatewayNamespace}/{GatewayName}, but if mergeGateways is set, they are merged under {GatewayClassName} key.
+func (t *Translator) getIRKey(gateway *gwapiv1.Gateway) string {
+	irKey := irStringKey(gateway.Namespace, gateway.Name)
+	if t.MergeGateways {
+		return string(t.GatewayClassName)
+	}
+
+	return irKey
+}
diff --git a/adapter/internal/operator/gateway-api/translator/accesslog.go b/adapter/internal/operator/gateway-api/translator/accesslog.go
new file mode 100644
index 000000000..eb53fe8b3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/accesslog.go
@@ -0,0 +1,277 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"sort"
+
+	accesslog "github.com/envoyproxy/go-control-plane/envoy/config/accesslog/v3"
+	cfgcore "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	fileaccesslog "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/file/v3"
+	grpcaccesslog "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/grpc/v3"
+	otelaccesslog "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/open_telemetry/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	otlpcommonv1 "go.opentelemetry.io/proto/otlp/common/v1"
+	"golang.org/x/exp/maps"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/structpb"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	// EnvoyTextLogFormat is the default log format for Envoy.
+	// See https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#default-format-string
+	EnvoyTextLogFormat = "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\"," +
+		"\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\"," +
+		"\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\"," +
+		"\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\"," +
+		"\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\"," +
+		"\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\"," +
+		"\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\"," +
+		"\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\"," +
+		"\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\"," +
+		"\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\"," +
+		"\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\"," +
+		"\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\"," +
+		"\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\"," +
+		"\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\"," +
+		"\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
+
+	otelLogName   = "otel_envoy_accesslog"
+	otelAccessLog = "envoy.access_loggers.open_telemetry"
+)
+
+var (
+	// for the case when a route does not exist to upstream, hcm logs will not be present
+	listenerAccessLogFilter = &accesslog.AccessLogFilter{
+		FilterSpecifier: &accesslog.AccessLogFilter_ResponseFlagFilter{
+			ResponseFlagFilter: &accesslog.ResponseFlagFilter{Flags: []string{"NR"}},
+		},
+	}
+)
+
+func buildXdsAccessLog(al *ir.AccessLog, forListener bool) []*accesslog.AccessLog {
+	if al == nil {
+		return nil
+	}
+
+	totalLen := len(al.Text) + len(al.JSON) + len(al.OpenTelemetry)
+	accessLogs := make([]*accesslog.AccessLog, 0, totalLen)
+	// handle text file access logs
+	for _, text := range al.Text {
+		filelog := &fileaccesslog.FileAccessLog{
+			Path: text.Path,
+		}
+		format := EnvoyTextLogFormat
+		if text.Format != nil {
+			format = *text.Format
+		}
+
+		filelog.AccessLogFormat = &fileaccesslog.FileAccessLog_LogFormat{
+			LogFormat: &cfgcore.SubstitutionFormatString{
+				Format: &cfgcore.SubstitutionFormatString_TextFormatSource{
+					TextFormatSource: &cfgcore.DataSource{
+						Specifier: &cfgcore.DataSource_InlineString{
+							InlineString: format,
+						},
+					},
+				},
+			},
+		}
+
+		// TODO: find a better way to handle this
+		accesslogAny, _ := anypb.New(filelog)
+		accessLogs = append(accessLogs, &accesslog.AccessLog{
+			Name: wellknown.FileAccessLog,
+			ConfigType: &accesslog.AccessLog_TypedConfig{
+				TypedConfig: accesslogAny,
+			},
+		})
+	}
+	// handle json file access logs
+	for _, json := range al.JSON {
+		jsonFormat := &structpb.Struct{
+			Fields: make(map[string]*structpb.Value, len(json.JSON)),
+		}
+
+		// sort keys to ensure consistent ordering
+		keys := maps.Keys(json.JSON)
+		sort.Strings(keys)
+
+		for _, key := range keys {
+			jsonFormat.Fields[key] = &structpb.Value{
+				Kind: &structpb.Value_StringValue{
+					StringValue: json.JSON[key],
+				},
+			}
+		}
+
+		filelog := &fileaccesslog.FileAccessLog{
+			Path: json.Path,
+			AccessLogFormat: &fileaccesslog.FileAccessLog_LogFormat{
+				LogFormat: &cfgcore.SubstitutionFormatString{
+					Format: &cfgcore.SubstitutionFormatString_JsonFormat{
+						JsonFormat: jsonFormat,
+					},
+				},
+			},
+		}
+
+		accesslogAny, _ := anypb.New(filelog)
+		accessLogs = append(accessLogs, &accesslog.AccessLog{
+			Name: wellknown.FileAccessLog,
+			ConfigType: &accesslog.AccessLog_TypedConfig{
+				TypedConfig: accesslogAny,
+			},
+		})
+	}
+	// handle open telemetry access logs
+	for _, otel := range al.OpenTelemetry {
+		al := &otelaccesslog.OpenTelemetryAccessLogConfig{
+			CommonConfig: &grpcaccesslog.CommonGrpcAccessLogConfig{
+				LogName: otelLogName,
+				GrpcService: &cfgcore.GrpcService{
+					TargetSpecifier: &cfgcore.GrpcService_EnvoyGrpc_{
+						EnvoyGrpc: &cfgcore.GrpcService_EnvoyGrpc{
+							ClusterName: buildClusterName("accesslog", otel.Host, otel.Port),
+							Authority:   otel.Host,
+						},
+					},
+				},
+				TransportApiVersion: cfgcore.ApiVersion_V3,
+			},
+			ResourceAttributes: convertToKeyValueList(otel.Resources, false),
+		}
+
+		format := EnvoyTextLogFormat
+		if otel.Text != nil {
+			format = *otel.Text
+		}
+
+		if format != "" {
+			al.Body = &otlpcommonv1.AnyValue{
+				Value: &otlpcommonv1.AnyValue_StringValue{
+					StringValue: format,
+				},
+			}
+		}
+
+		al.Attributes = convertToKeyValueList(otel.Attributes, true)
+
+		accesslogAny, _ := anypb.New(al)
+		accessLogs = append(accessLogs, &accesslog.AccessLog{
+			Name: otelAccessLog,
+			ConfigType: &accesslog.AccessLog_TypedConfig{
+				TypedConfig: accesslogAny,
+			},
+		})
+	}
+
+	// add filter for listener access logs
+	if forListener {
+		for _, al := range accessLogs {
+			al.Filter = listenerAccessLogFilter
+		}
+	}
+
+	return accessLogs
+}
+
+// read more here: https://opentelemetry.io/docs/specs/otel/resource/semantic_conventions/k8s/
+const (
+	k8sNamespaceNameKey = "k8s.namespace.name"
+	k8sPodNameKey       = "k8s.pod.name"
+)
+
+func convertToKeyValueList(attributes map[string]string, additionalLabels bool) *otlpcommonv1.KeyValueList {
+	maxLen := len(attributes)
+	if additionalLabels {
+		maxLen += 2
+	}
+	keyValueList := &otlpcommonv1.KeyValueList{
+		Values: make([]*otlpcommonv1.KeyValue, 0, maxLen),
+	}
+
+	// always set the k8s namespace and pod name for better UX
+	// EG cannot know the client namespace and pod name,
+	// so we set these on attributes that read from the environment.
+	if additionalLabels {
+		// TODO: check the provider type and set the appropriate attributes
+		keyValueList.Values = append(keyValueList.Values, &otlpcommonv1.KeyValue{
+			Key:   k8sNamespaceNameKey,
+			Value: &otlpcommonv1.AnyValue{Value: &otlpcommonv1.AnyValue_StringValue{StringValue: "%ENVIRONMENT(ENVOY_GATEWAY_NAMESPACE)%"}},
+		})
+
+		keyValueList.Values = append(keyValueList.Values, &otlpcommonv1.KeyValue{
+			Key:   k8sPodNameKey,
+			Value: &otlpcommonv1.AnyValue{Value: &otlpcommonv1.AnyValue_StringValue{StringValue: "%ENVIRONMENT(ENVOY_POD_NAME)%"}},
+		})
+	}
+
+	if len(attributes) == 0 {
+		return keyValueList
+	}
+
+	// sort keys to ensure consistent ordering
+	keys := maps.Keys(attributes)
+	sort.Strings(keys)
+
+	for _, key := range keys {
+		keyValueList.Values = append(keyValueList.Values, &otlpcommonv1.KeyValue{
+			Key:   key,
+			Value: &otlpcommonv1.AnyValue{Value: &otlpcommonv1.AnyValue_StringValue{StringValue: attributes[key]}},
+		})
+	}
+
+	return keyValueList
+}
+
+func processClusterForAccessLog(tCtx *types.ResourceVersionTable, al *ir.AccessLog) error {
+	if al == nil {
+		return nil
+	}
+
+	for _, otel := range al.OpenTelemetry {
+		clusterName := buildClusterName("accesslog", otel.Host, otel.Port)
+
+		ds := &ir.DestinationSetting{
+			Weight:    ptr.To[uint32](1),
+			Protocol:  ir.GRPC,
+			Endpoints: []*ir.DestinationEndpoint{ir.NewDestEndpoint(otel.Host, otel.Port)},
+		}
+		if err := addXdsCluster(tCtx, &xdsClusterArgs{
+			name:         clusterName,
+			settings:     []*ir.DestinationSetting{ds},
+			tSocket:      nil,
+			endpointType: EndpointTypeDNS,
+		}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+			return err
+		}
+
+	}
+
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/basicauth.go b/adapter/internal/operator/gateway-api/translator/basicauth.go
new file mode 100644
index 000000000..5fd4932f9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/basicauth.go
@@ -0,0 +1,149 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	basicauthv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/basic_auth/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+const (
+	basicAuthFilter = "envoy.filters.http.basic_auth"
+)
+
+func init() {
+	registerHTTPFilter(&basicAuth{})
+}
+
+type basicAuth struct {
+}
+
+var _ httpFilter = &basicAuth{}
+
+// patchHCM builds and appends the basic_auth Filters to the HTTP Connection Manager
+// if applicable, and it does not already exist.
+// Note: this method creates an basic_auth filter for each route that contains an BasicAuth config.
+// The filter is disabled by default. It is enabled on the route level.
+func (*basicAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error {
+	var errs error
+
+	if mgr == nil {
+		return errors.New("hcm is nil")
+	}
+
+	if irListener == nil {
+		return errors.New("ir listener is nil")
+	}
+
+	for _, route := range irListener.Routes {
+		if !routeContainsBasicAuth(route) {
+			continue
+		}
+
+		filter, err := buildHCMBasicAuthFilter(route)
+		if err != nil {
+			errs = errors.Join(errs, err)
+			continue
+		}
+
+		mgr.HttpFilters = append(mgr.HttpFilters, filter)
+	}
+
+	return errs
+}
+
+// buildHCMBasicAuthFilter returns a basic_auth HTTP filter from the provided IR HTTPRoute.
+func buildHCMBasicAuthFilter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
+	basicAuthProto := basicAuthConfig(route)
+
+	if err := basicAuthProto.ValidateAll(); err != nil {
+		return nil, err
+	}
+
+	basicAuthAny, err := anypb.New(basicAuthProto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &hcmv3.HttpFilter{
+		Name:     basicAuthFilterName(route),
+		Disabled: true,
+		ConfigType: &hcmv3.HttpFilter_TypedConfig{
+			TypedConfig: basicAuthAny,
+		},
+	}, nil
+}
+
+func basicAuthFilterName(route *ir.HTTPRoute) string {
+	return perRouteFilterName(basicAuthFilter, route.Name)
+}
+
+func basicAuthConfig(route *ir.HTTPRoute) *basicauthv3.BasicAuth {
+	return &basicauthv3.BasicAuth{
+		Users: &corev3.DataSource{
+			Specifier: &corev3.DataSource_InlineBytes{
+				InlineBytes: route.BasicAuth.Users,
+			},
+		},
+	}
+}
+
+// routeContainsBasicAuth returns true if BasicAuth exists for the provided route.
+func routeContainsBasicAuth(irRoute *ir.HTTPRoute) bool {
+	if irRoute == nil {
+		return false
+	}
+
+	if irRoute != nil &&
+		irRoute.BasicAuth != nil {
+		return true
+	}
+
+	return false
+}
+
+func (*basicAuth) patchResources(*types.ResourceVersionTable, []*ir.HTTPRoute) error {
+	return nil
+}
+
+// patchRoute patches the provided route with the basicAuth config if applicable.
+// Note: this method enables the corresponding basicAuth filter for the provided route.
+func (*basicAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+	if irRoute.BasicAuth == nil {
+		return nil
+	}
+	return enableFilterOnRoute(basicAuthFilter, route, irRoute)
+}
diff --git a/adapter/internal/operator/gateway-api/translator/cluster.go b/adapter/internal/operator/gateway-api/translator/cluster.go
new file mode 100644
index 000000000..fe29398cf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/cluster.go
@@ -0,0 +1,629 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"encoding/hex"
+	"fmt"
+	"sort"
+	"time"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	preservecasev3 "github.com/envoyproxy/go-control-plane/envoy/extensions/http/header_formatters/preserve_case/v3"
+	proxyprotocolv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/proxy_protocol/v3"
+	rawbufferv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/raw_buffer/v3"
+	httpv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/upstreams/http/v3"
+	xdstype "github.com/envoyproxy/go-control-plane/envoy/type/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/structpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	extensionOptionsKey = "envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-field-config-cluster-v3-cluster-per-connection-buffer-limit-bytes
+	tcpClusterPerConnectionBufferLimitBytes = 32768
+	tcpClusterPerConnectTimeout             = 10 * time.Second
+)
+
+type xdsClusterArgs struct {
+	name           string
+	settings       []*ir.DestinationSetting
+	tSocket        *corev3.TransportSocket
+	endpointType   EndpointType
+	loadBalancer   *ir.LoadBalancer
+	proxyProtocol  *ir.ProxyProtocol
+	circuitBreaker *ir.CircuitBreaker
+	healthCheck    *ir.HealthCheck
+	http1Settings  *ir.HTTP1Settings
+	timeout        *ir.Timeout
+	tcpkeepalive   *ir.TCPKeepalive
+}
+
+type EndpointType int
+
+const (
+	EndpointTypeDNS EndpointType = iota
+	EndpointTypeStatic
+)
+
+func buildEndpointType(settings []*ir.DestinationSetting) EndpointType {
+	// Get endpoint address type for xds cluster by returning the first DestinationSetting's AddressType,
+	// since there's no Mixed AddressType among all the DestinationSettings.
+	if settings == nil {
+		return EndpointTypeStatic
+	}
+
+	addrType := settings[0].AddressType
+
+	if addrType != nil && *addrType == ir.FQDN {
+		return EndpointTypeDNS
+	}
+
+	return EndpointTypeStatic
+}
+
+func buildXdsCluster(args *xdsClusterArgs) *clusterv3.Cluster {
+	cluster := &clusterv3.Cluster{
+		Name:            args.name,
+		DnsLookupFamily: clusterv3.Cluster_V4_ONLY,
+		CommonLbConfig: &clusterv3.Cluster_CommonLbConfig{
+			LocalityConfigSpecifier: &clusterv3.Cluster_CommonLbConfig_LocalityWeightedLbConfig_{
+				LocalityWeightedLbConfig: &clusterv3.Cluster_CommonLbConfig_LocalityWeightedLbConfig{}}},
+		OutlierDetection:              &clusterv3.OutlierDetection{},
+		PerConnectionBufferLimitBytes: wrapperspb.UInt32(tcpClusterPerConnectionBufferLimitBytes),
+	}
+
+	cluster.ConnectTimeout = buildConnectTimeout(args.timeout)
+
+	// Set Proxy Protocol
+	if args.proxyProtocol != nil {
+		cluster.TransportSocket = buildProxyProtocolSocket(args.proxyProtocol, args.tSocket)
+	} else if args.tSocket != nil {
+		cluster.TransportSocket = args.tSocket
+	}
+
+	for i, ds := range args.settings {
+		if ds.TLS != nil {
+			socket, err := buildXdsUpstreamTLSSocketWthCert(ds.TLS)
+			if err != nil {
+				// TODO: Log something here
+				return nil
+			}
+			if args.proxyProtocol != nil {
+				socket = buildProxyProtocolSocket(args.proxyProtocol, socket)
+			}
+			matchName := fmt.Sprintf("%s/tls/%d", args.name, i)
+			cluster.TransportSocketMatches = append(cluster.TransportSocketMatches, &clusterv3.Cluster_TransportSocketMatch{
+				Name: matchName,
+				Match: &structpb.Struct{
+					Fields: map[string]*structpb.Value{
+						"name": structpb.NewStringValue(matchName),
+					},
+				},
+				TransportSocket: socket,
+			})
+		}
+	}
+
+	if args.endpointType == EndpointTypeStatic {
+		cluster.ClusterDiscoveryType = &clusterv3.Cluster_Type{Type: clusterv3.Cluster_EDS}
+		cluster.EdsClusterConfig = &clusterv3.Cluster_EdsClusterConfig{
+			ServiceName: args.name,
+			EdsConfig: &corev3.ConfigSource{
+				ResourceApiVersion: resource.DefaultAPIVersion,
+				ConfigSourceSpecifier: &corev3.ConfigSource_Ads{
+					Ads: &corev3.AggregatedConfigSource{},
+				},
+			},
+		}
+	} else {
+		cluster.ClusterDiscoveryType = &clusterv3.Cluster_Type{Type: clusterv3.Cluster_STRICT_DNS}
+		cluster.DnsRefreshRate = durationpb.New(30 * time.Second)
+		cluster.RespectDnsTtl = true
+	}
+
+	// build common, HTTP/1 and HTTP/2  protocol options for cluster
+	epo := buildTypedExtensionProtocolOptions(args)
+	if epo != nil {
+		cluster.TypedExtensionProtocolOptions = epo
+	}
+
+	// Set Load Balancer policy
+	//nolint:gocritic
+	if args.loadBalancer == nil {
+		cluster.LbPolicy = clusterv3.Cluster_LEAST_REQUEST
+	} else if args.loadBalancer.LeastRequest != nil {
+		cluster.LbPolicy = clusterv3.Cluster_LEAST_REQUEST
+		if args.loadBalancer.LeastRequest.SlowStart != nil {
+			if args.loadBalancer.LeastRequest.SlowStart.Window != nil {
+				cluster.LbConfig = &clusterv3.Cluster_LeastRequestLbConfig_{
+					LeastRequestLbConfig: &clusterv3.Cluster_LeastRequestLbConfig{
+						SlowStartConfig: &clusterv3.Cluster_SlowStartConfig{
+							SlowStartWindow: durationpb.New(args.loadBalancer.LeastRequest.SlowStart.Window.Duration),
+						},
+					},
+				}
+			}
+		}
+	} else if args.loadBalancer.RoundRobin != nil {
+		cluster.LbPolicy = clusterv3.Cluster_ROUND_ROBIN
+		if args.loadBalancer.RoundRobin.SlowStart != nil {
+			if args.loadBalancer.RoundRobin.SlowStart.Window != nil {
+				cluster.LbConfig = &clusterv3.Cluster_RoundRobinLbConfig_{
+					RoundRobinLbConfig: &clusterv3.Cluster_RoundRobinLbConfig{
+						SlowStartConfig: &clusterv3.Cluster_SlowStartConfig{
+							SlowStartWindow: durationpb.New(args.loadBalancer.RoundRobin.SlowStart.Window.Duration),
+						},
+					},
+				}
+			}
+		}
+	} else if args.loadBalancer.Random != nil {
+		cluster.LbPolicy = clusterv3.Cluster_RANDOM
+	} else if args.loadBalancer.ConsistentHash != nil {
+		cluster.LbPolicy = clusterv3.Cluster_MAGLEV
+	}
+
+	if args.healthCheck != nil && args.healthCheck.Active != nil {
+		cluster.HealthChecks = buildXdsHealthCheck(args.healthCheck.Active)
+	}
+
+	if args.healthCheck != nil && args.healthCheck.Passive != nil {
+		cluster.OutlierDetection = buildXdsOutlierDetection(args.healthCheck.Passive)
+
+	}
+
+	cluster.CircuitBreakers = buildXdsClusterCircuitBreaker(args.circuitBreaker)
+
+	if args.tcpkeepalive != nil {
+		cluster.UpstreamConnectionOptions = buildXdsClusterUpstreamOptions(args.tcpkeepalive)
+	}
+	return cluster
+}
+
+func buildXdsHealthCheck(healthcheck *ir.ActiveHealthCheck) []*corev3.HealthCheck {
+	hc := &corev3.HealthCheck{
+		Timeout:  durationpb.New(healthcheck.Timeout.Duration),
+		Interval: durationpb.New(healthcheck.Interval.Duration),
+	}
+	if healthcheck.UnhealthyThreshold != nil {
+		hc.UnhealthyThreshold = wrapperspb.UInt32(*healthcheck.UnhealthyThreshold)
+	}
+	if healthcheck.HealthyThreshold != nil {
+		hc.HealthyThreshold = wrapperspb.UInt32(*healthcheck.HealthyThreshold)
+	}
+	if healthcheck.HTTP != nil {
+		httpChecker := &corev3.HealthCheck_HttpHealthCheck{
+			Host: healthcheck.HTTP.Host,
+			Path: healthcheck.HTTP.Path,
+		}
+		if healthcheck.HTTP.Method != nil {
+			httpChecker.Method = corev3.RequestMethod(corev3.RequestMethod_value[*healthcheck.HTTP.Method])
+		}
+		httpChecker.ExpectedStatuses = buildHTTPStatusRange(healthcheck.HTTP.ExpectedStatuses)
+		if receive := buildHealthCheckPayload(healthcheck.HTTP.ExpectedResponse); receive != nil {
+			httpChecker.Receive = append(httpChecker.Receive, receive)
+		}
+		hc.HealthChecker = &corev3.HealthCheck_HttpHealthCheck_{
+			HttpHealthCheck: httpChecker,
+		}
+	}
+	if healthcheck.TCP != nil {
+		tcpChecker := &corev3.HealthCheck_TcpHealthCheck{
+			Send: buildHealthCheckPayload(healthcheck.TCP.Send),
+		}
+		if receive := buildHealthCheckPayload(healthcheck.TCP.Receive); receive != nil {
+			tcpChecker.Receive = append(tcpChecker.Receive, receive)
+		}
+		hc.HealthChecker = &corev3.HealthCheck_TcpHealthCheck_{
+			TcpHealthCheck: tcpChecker,
+		}
+	}
+	return []*corev3.HealthCheck{hc}
+}
+
+func buildXdsOutlierDetection(outlierDetection *ir.OutlierDetection) *clusterv3.OutlierDetection {
+	od := &clusterv3.OutlierDetection{
+		BaseEjectionTime: durationpb.New(outlierDetection.BaseEjectionTime.Duration),
+		Interval:         durationpb.New(outlierDetection.Interval.Duration),
+	}
+	if outlierDetection.SplitExternalLocalOriginErrors != nil {
+		od.SplitExternalLocalOriginErrors = *outlierDetection.SplitExternalLocalOriginErrors
+	}
+
+	if outlierDetection.MaxEjectionPercent != nil && *outlierDetection.MaxEjectionPercent > 0 {
+		od.MaxEjectionPercent = wrapperspb.UInt32(uint32(*outlierDetection.MaxEjectionPercent))
+	}
+
+	if outlierDetection.ConsecutiveLocalOriginFailures != nil {
+		od.ConsecutiveLocalOriginFailure = wrapperspb.UInt32(*outlierDetection.ConsecutiveLocalOriginFailures)
+	}
+
+	if outlierDetection.Consecutive5xxErrors != nil {
+		od.Consecutive_5Xx = wrapperspb.UInt32(*outlierDetection.Consecutive5xxErrors)
+	}
+
+	if outlierDetection.ConsecutiveGatewayErrors != nil {
+		od.ConsecutiveGatewayFailure = wrapperspb.UInt32(*outlierDetection.ConsecutiveGatewayErrors)
+	}
+
+	return od
+}
+
+// buildHTTPStatusRange converts an array of http status to an array of the range of http status.
+func buildHTTPStatusRange(irStatuses []ir.HTTPStatus) []*xdstype.Int64Range {
+	if len(irStatuses) == 0 {
+		return nil
+	}
+	ranges := []*xdstype.Int64Range{}
+	sort.Slice(irStatuses, func(i int, j int) bool {
+		return irStatuses[i] < irStatuses[j]
+	})
+	var start, end int64
+	for i := 0; i < len(irStatuses); i++ {
+		switch {
+		case start == 0:
+			start = int64(irStatuses[i])
+			end = int64(irStatuses[i] + 1)
+		case int64(irStatuses[i]) == end:
+			end++
+		default:
+			ranges = append(ranges, &xdstype.Int64Range{Start: start, End: end})
+			start = int64(irStatuses[i])
+			end = int64(irStatuses[i] + 1)
+		}
+	}
+	if start != 0 {
+		ranges = append(ranges, &xdstype.Int64Range{Start: start, End: end})
+	}
+	return ranges
+}
+
+func buildHealthCheckPayload(irLoad *ir.HealthCheckPayload) *corev3.HealthCheck_Payload {
+	if irLoad == nil {
+		return nil
+	}
+
+	var hcp corev3.HealthCheck_Payload
+	if irLoad.Text != nil && *irLoad.Text != "" {
+		hcp.Payload = &corev3.HealthCheck_Payload_Text{
+			Text: hex.EncodeToString([]byte(*irLoad.Text)),
+		}
+	}
+	if len(irLoad.Binary) > 0 {
+		binPayload := &corev3.HealthCheck_Payload_Binary{
+			Binary: make([]byte, len(irLoad.Binary)),
+		}
+		copy(binPayload.Binary, irLoad.Binary)
+		hcp.Payload = binPayload
+	}
+	return &hcp
+}
+
+func buildXdsClusterCircuitBreaker(circuitBreaker *ir.CircuitBreaker) *clusterv3.CircuitBreakers {
+	// Always allow the same amount of retries as regular requests to handle surges in retries
+	// related to pod restarts
+	cbt := &clusterv3.CircuitBreakers_Thresholds{
+		Priority: corev3.RoutingPriority_DEFAULT,
+		MaxRetries: &wrapperspb.UInt32Value{
+			Value: uint32(1024),
+		},
+	}
+
+	if circuitBreaker != nil {
+		if circuitBreaker.MaxConnections != nil {
+			cbt.MaxConnections = &wrapperspb.UInt32Value{
+				Value: *circuitBreaker.MaxConnections,
+			}
+		}
+
+		if circuitBreaker.MaxPendingRequests != nil {
+			cbt.MaxPendingRequests = &wrapperspb.UInt32Value{
+				Value: *circuitBreaker.MaxPendingRequests,
+			}
+		}
+
+		if circuitBreaker.MaxParallelRequests != nil {
+			cbt.MaxRequests = &wrapperspb.UInt32Value{
+				Value: *circuitBreaker.MaxParallelRequests,
+			}
+		}
+
+		if circuitBreaker.MaxParallelRetries != nil {
+			cbt.MaxRetries = &wrapperspb.UInt32Value{
+				Value: *circuitBreaker.MaxParallelRetries,
+			}
+		}
+	}
+
+	ecb := &clusterv3.CircuitBreakers{
+		Thresholds: []*clusterv3.CircuitBreakers_Thresholds{cbt},
+	}
+
+	return ecb
+}
+
+func buildXdsClusterLoadAssignment(clusterName string, destSettings []*ir.DestinationSetting) *endpointv3.ClusterLoadAssignment {
+	localities := make([]*endpointv3.LocalityLbEndpoints, 0, len(destSettings))
+	for i, ds := range destSettings {
+
+		endpoints := make([]*endpointv3.LbEndpoint, 0, len(ds.Endpoints))
+
+		var metadata *corev3.Metadata
+		if ds.TLS != nil {
+			metadata = &corev3.Metadata{
+				FilterMetadata: map[string]*structpb.Struct{
+					"envoy.transport_socket_match": {
+						Fields: map[string]*structpb.Value{
+							"name": structpb.NewStringValue(fmt.Sprintf("%s/tls/%d", clusterName, i)),
+						},
+					},
+				},
+			}
+		}
+
+		for _, irEp := range ds.Endpoints {
+			lbEndpoint := &endpointv3.LbEndpoint{
+				Metadata: metadata,
+				HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+					Endpoint: &endpointv3.Endpoint{
+						Address: &corev3.Address{
+							Address: &corev3.Address_SocketAddress{
+								SocketAddress: &corev3.SocketAddress{
+									Protocol: corev3.SocketAddress_TCP,
+									Address:  irEp.Host,
+									PortSpecifier: &corev3.SocketAddress_PortValue{
+										PortValue: irEp.Port,
+									},
+								},
+							},
+						},
+					},
+				},
+			}
+			// Set default weight of 1 for all endpoints.
+			lbEndpoint.LoadBalancingWeight = &wrapperspb.UInt32Value{Value: 1}
+			endpoints = append(endpoints, lbEndpoint)
+		}
+
+		// Envoy requires a distinct region to be set for each LocalityLbEndpoints.
+		// If we don't do this, Envoy will merge all LocalityLbEndpoints into one.
+		// We use the name of the backendRef as a pseudo region name.
+		locality := &endpointv3.LocalityLbEndpoints{
+			Locality: &corev3.Locality{
+				Region: fmt.Sprintf("%s/backend/%d", clusterName, i),
+			},
+			LbEndpoints: endpoints,
+			Priority:    0,
+		}
+
+		// Set locality weight
+		var weight uint32
+		if ds.Weight != nil {
+			weight = *ds.Weight
+		} else {
+			weight = 1
+		}
+		locality.LoadBalancingWeight = &wrapperspb.UInt32Value{Value: weight}
+
+		localities = append(localities, locality)
+	}
+	return &endpointv3.ClusterLoadAssignment{ClusterName: clusterName, Endpoints: localities}
+}
+
+func buildTypedExtensionProtocolOptions(args *xdsClusterArgs) map[string]*anypb.Any {
+	requiresHTTP2Options := false
+	for _, ds := range args.settings {
+		if ds.Protocol == ir.GRPC ||
+			ds.Protocol == ir.HTTP2 {
+			requiresHTTP2Options = true
+			break
+		}
+	}
+
+	requiresCommonHTTPOptions := (args.timeout != nil && args.timeout.HTTP != nil &&
+		(args.timeout.HTTP.MaxConnectionDuration != nil || args.timeout.HTTP.ConnectionIdleTimeout != nil)) ||
+		(args.circuitBreaker != nil && args.circuitBreaker.MaxRequestsPerConnection != nil)
+
+	requiresHTTP1Options := args.http1Settings != nil && (args.http1Settings.EnableTrailers || args.http1Settings.PreserveHeaderCase || args.http1Settings.HTTP10 != nil)
+
+	if !(requiresCommonHTTPOptions || requiresHTTP1Options || requiresHTTP2Options) {
+		return nil
+	}
+
+	protocolOptions := httpv3.HttpProtocolOptions{}
+
+	if requiresCommonHTTPOptions {
+		protocolOptions.CommonHttpProtocolOptions = &corev3.HttpProtocolOptions{}
+
+		if args.timeout != nil && args.timeout.HTTP != nil {
+			if args.timeout.HTTP.ConnectionIdleTimeout != nil {
+				protocolOptions.CommonHttpProtocolOptions.IdleTimeout =
+					durationpb.New(args.timeout.HTTP.ConnectionIdleTimeout.Duration)
+			}
+
+			if args.timeout.HTTP.MaxConnectionDuration != nil {
+				protocolOptions.CommonHttpProtocolOptions.MaxConnectionDuration =
+					durationpb.New(args.timeout.HTTP.MaxConnectionDuration.Duration)
+			}
+		}
+
+		if args.circuitBreaker != nil && args.circuitBreaker.MaxRequestsPerConnection != nil {
+			protocolOptions.CommonHttpProtocolOptions.MaxRequestsPerConnection = &wrapperspb.UInt32Value{
+				Value: *args.circuitBreaker.MaxRequestsPerConnection,
+			}
+		}
+
+	}
+
+	// When setting any Typed Extension Protocol Options, UpstreamProtocolOptions are mandatory
+	// If translation requires HTTP2 enablement or HTTP1 trailers, set appropriate setting
+	// Default to http1 otherwise
+	// TODO: If the cluster is TLS enabled, use AutoHTTPConfig instead of ExplicitHttpConfig
+	// so that when ALPN is supported then enabling http1 options doesn't force HTTP/1.1
+	switch {
+	case requiresHTTP2Options:
+		protocolOptions.UpstreamProtocolOptions = &httpv3.HttpProtocolOptions_ExplicitHttpConfig_{
+			ExplicitHttpConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig{
+				ProtocolConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig_Http2ProtocolOptions{},
+			},
+		}
+	case requiresHTTP1Options:
+		http1opts := &corev3.Http1ProtocolOptions{
+			EnableTrailers: args.http1Settings.EnableTrailers,
+		}
+		if args.http1Settings.PreserveHeaderCase {
+			preservecaseAny, _ := anypb.New(&preservecasev3.PreserveCaseFormatterConfig{})
+			http1opts.HeaderKeyFormat = &corev3.Http1ProtocolOptions_HeaderKeyFormat{
+				HeaderFormat: &corev3.Http1ProtocolOptions_HeaderKeyFormat_StatefulFormatter{
+					StatefulFormatter: &corev3.TypedExtensionConfig{
+						Name:        "preserve_case",
+						TypedConfig: preservecaseAny,
+					},
+				},
+			}
+		}
+		if args.http1Settings.HTTP10 != nil {
+			http1opts.AcceptHttp_10 = true
+			http1opts.DefaultHostForHttp_10 = ptr.Deref(args.http1Settings.HTTP10.DefaultHost, "")
+		}
+		protocolOptions.UpstreamProtocolOptions = &httpv3.HttpProtocolOptions_ExplicitHttpConfig_{
+			ExplicitHttpConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig{
+				ProtocolConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig_HttpProtocolOptions{
+					HttpProtocolOptions: http1opts,
+				},
+			},
+		}
+	default:
+		protocolOptions.UpstreamProtocolOptions = &httpv3.HttpProtocolOptions_ExplicitHttpConfig_{
+			ExplicitHttpConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig{
+				ProtocolConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig_HttpProtocolOptions{},
+			},
+		}
+	}
+
+	anyProtocolOptions, _ := anypb.New(&protocolOptions)
+
+	extensionOptions := map[string]*anypb.Any{
+		extensionOptionsKey: anyProtocolOptions,
+	}
+
+	return extensionOptions
+}
+
+// buildClusterName returns a cluster name for the given `host` and `port`.
+// The format is: <type>|<host>|<port>, where type is "accesslog" for access logs.
+// It's easy to distinguish when debugging.
+func buildClusterName(prefix string, host string, port uint32) string {
+	return fmt.Sprintf("%s|%s|%d", prefix, host, port)
+}
+
+// buildProxyProtocolSocket builds the ProxyProtocol transport socket.
+func buildProxyProtocolSocket(proxyProtocol *ir.ProxyProtocol, tSocket *corev3.TransportSocket) *corev3.TransportSocket {
+	if proxyProtocol == nil {
+		return nil
+	}
+
+	ppCtx := &proxyprotocolv3.ProxyProtocolUpstreamTransport{}
+
+	switch proxyProtocol.Version {
+	case ir.ProxyProtocolVersionV1:
+		ppCtx.Config = &corev3.ProxyProtocolConfig{
+			Version: corev3.ProxyProtocolConfig_V1,
+		}
+	case ir.ProxyProtocolVersionV2:
+		ppCtx.Config = &corev3.ProxyProtocolConfig{
+			Version: corev3.ProxyProtocolConfig_V2,
+		}
+	}
+
+	// If existing transport socket does not exist wrap around raw buffer
+	if tSocket == nil {
+		rawCtx := &rawbufferv3.RawBuffer{}
+		rawCtxAny, err := anypb.New(rawCtx)
+		if err != nil {
+			return nil
+		}
+		rawSocket := &corev3.TransportSocket{
+			Name: wellknown.TransportSocketRawBuffer,
+			ConfigType: &corev3.TransportSocket_TypedConfig{
+				TypedConfig: rawCtxAny,
+			},
+		}
+		ppCtx.TransportSocket = rawSocket
+	} else {
+		ppCtx.TransportSocket = tSocket
+	}
+
+	ppCtxAny, err := anypb.New(ppCtx)
+	if err != nil {
+		return nil
+	}
+
+	return &corev3.TransportSocket{
+		Name: "envoy.transport_sockets.upstream_proxy_protocol",
+		ConfigType: &corev3.TransportSocket_TypedConfig{
+			TypedConfig: ppCtxAny,
+		},
+	}
+}
+
+func buildConnectTimeout(to *ir.Timeout) *durationpb.Duration {
+	if to != nil && to.TCP != nil && to.TCP.ConnectTimeout != nil {
+		return durationpb.New(to.TCP.ConnectTimeout.Duration)
+	}
+	return durationpb.New(tcpClusterPerConnectTimeout)
+}
+
+func buildXdsClusterUpstreamOptions(tcpkeepalive *ir.TCPKeepalive) *clusterv3.UpstreamConnectionOptions {
+	if tcpkeepalive == nil {
+		return nil
+	}
+
+	ka := &clusterv3.UpstreamConnectionOptions{
+		TcpKeepalive: &corev3.TcpKeepalive{},
+	}
+
+	if tcpkeepalive.Probes != nil {
+		ka.TcpKeepalive.KeepaliveProbes = wrapperspb.UInt32(*tcpkeepalive.Probes)
+	}
+
+	if tcpkeepalive.Probes != nil {
+		ka.TcpKeepalive.KeepaliveTime = wrapperspb.UInt32(*tcpkeepalive.IdleTime)
+	}
+
+	if tcpkeepalive.Interval != nil {
+		ka.TcpKeepalive.KeepaliveInterval = wrapperspb.UInt32(*tcpkeepalive.Interval)
+	}
+
+	return ka
+
+}
diff --git a/adapter/internal/operator/gateway-api/translator/cors.go b/adapter/internal/operator/gateway-api/translator/cors.go
new file mode 100644
index 000000000..ba2724016
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/cors.go
@@ -0,0 +1,186 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	corsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/cors/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/golang/protobuf/ptypes/wrappers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+func init() {
+	registerHTTPFilter(&cors{})
+}
+
+type cors struct {
+}
+
+var _ httpFilter = &cors{}
+
+// patchHCM builds and appends the CORS Filter to the HTTP Connection Manager if
+// applicable.
+func (*cors) patchHCM(
+	mgr *hcmv3.HttpConnectionManager,
+	irListener *ir.HTTPListener) error {
+	if mgr == nil {
+		return errors.New("hcm is nil")
+	}
+
+	if irListener == nil {
+		return errors.New("ir listener is nil")
+	}
+
+	if !listenerContainsCORS(irListener) {
+		return nil
+	}
+
+	// Return early if filter already exists.
+	for _, httpFilter := range mgr.HttpFilters {
+		if httpFilter.Name == wellknown.CORS {
+			return nil
+		}
+	}
+
+	corsFilter, err := buildHCMCORSFilter()
+	if err != nil {
+		return err
+	}
+
+	// Ensure the CORS filter is the first one in the filter chain.
+	mgr.HttpFilters = append([]*hcmv3.HttpFilter{corsFilter}, mgr.HttpFilters...)
+
+	return nil
+}
+
+// buildHCMCORSFilter returns a CORS filter from the provided IR listener.
+func buildHCMCORSFilter() (*hcmv3.HttpFilter, error) {
+	corsProto := &corsv3.Cors{}
+
+	corsAny, err := anypb.New(corsProto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &hcmv3.HttpFilter{
+		Name: wellknown.CORS,
+		ConfigType: &hcmv3.HttpFilter_TypedConfig{
+			TypedConfig: corsAny,
+		},
+	}, nil
+}
+
+// listenerContainsCORS returns true if the provided listener has CORS
+// policies attached to its routes.
+func listenerContainsCORS(irListener *ir.HTTPListener) bool {
+	if irListener == nil {
+		return false
+	}
+
+	for _, route := range irListener.Routes {
+		if route.CORS != nil {
+			return true
+		}
+	}
+
+	return false
+}
+
+// patchRoute patches the provided route with the CORS config if applicable.
+func (*cors) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+	if irRoute.CORS == nil {
+		return nil
+	}
+
+	filterCfg := route.GetTypedPerFilterConfig()
+	if _, ok := filterCfg[wellknown.CORS]; ok {
+		// This should not happen since this is the only place where the CORS
+		// filter is added in a route.
+		return fmt.Errorf("route already contains cors config: %+v", route)
+	}
+
+	var (
+		allowOrigins     []*matcherv3.StringMatcher
+		allowMethods     string
+		allowHeaders     string
+		exposeHeaders    string
+		maxAge           string
+		allowCredentials *wrappers.BoolValue
+	)
+
+	//nolint:gocritic
+
+	for _, origin := range irRoute.CORS.AllowOrigins {
+		allowOrigins = append(allowOrigins, buildXdsStringMatcher(origin))
+	}
+
+	allowMethods = strings.Join(irRoute.CORS.AllowMethods, ", ")
+	allowHeaders = strings.Join(irRoute.CORS.AllowHeaders, ", ")
+	exposeHeaders = strings.Join(irRoute.CORS.ExposeHeaders, ", ")
+	if irRoute.CORS.MaxAge != nil {
+		maxAge = strconv.Itoa(int(irRoute.CORS.MaxAge.Seconds()))
+	}
+	allowCredentials = &wrappers.BoolValue{Value: irRoute.CORS.AllowCredentials}
+
+	routeCfgProto := &corsv3.CorsPolicy{
+		AllowOriginStringMatch: allowOrigins,
+		AllowMethods:           allowMethods,
+		AllowHeaders:           allowHeaders,
+		ExposeHeaders:          exposeHeaders,
+		MaxAge:                 maxAge,
+		AllowCredentials:       allowCredentials,
+	}
+
+	routeCfgAny, err := anypb.New(routeCfgProto)
+	if err != nil {
+		return err
+	}
+
+	if filterCfg == nil {
+		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
+	}
+
+	route.TypedPerFilterConfig[wellknown.CORS] = routeCfgAny
+
+	return nil
+}
+
+func (c *cors) patchResources(*types.ResourceVersionTable, []*ir.HTTPRoute) error {
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/extauth.go b/adapter/internal/operator/gateway-api/translator/extauth.go
new file mode 100644
index 000000000..c50c584cf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/extauth.go
@@ -0,0 +1,300 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"net/url"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	extauthv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	"github.com/golang/protobuf/ptypes/duration"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+const (
+	extAuthFilter = "envoy.filters.http.ext_authz"
+)
+
+func init() {
+	registerHTTPFilter(&extAuth{})
+}
+
+type extAuth struct {
+}
+
+var _ httpFilter = &extAuth{}
+
+// patchHCM builds and appends the ext_authz Filters to the HTTP Connection Manager
+// if applicable, and it does not already exist.
+// Note: this method creates an ext_authz filter for each route that contains an ExtAuthz config.
+// The filter is disabled by default. It is enabled on the route level.
+// TODO: zhaohuabing avoid duplicated HTTP filters
+func (*extAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error {
+	var errs error
+
+	if mgr == nil {
+		return errors.New("hcm is nil")
+	}
+
+	if irListener == nil {
+		return errors.New("ir listener is nil")
+	}
+
+	for _, route := range irListener.Routes {
+		if !routeContainsExtAuth(route) {
+			continue
+		}
+
+		filter, err := buildHCMExtAuthFilter(route)
+		if err != nil {
+			errs = errors.Join(errs, err)
+			continue
+		}
+
+		mgr.HttpFilters = append(mgr.HttpFilters, filter)
+	}
+
+	return errs
+}
+
+// buildHCMExtAuthFilter returns an ext_authz HTTP filter from the provided IR HTTPRoute.
+func buildHCMExtAuthFilter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
+	extAuthProto := extAuthConfig(route.ExtAuth)
+	if err := extAuthProto.ValidateAll(); err != nil {
+		return nil, err
+	}
+
+	extAuthAny, err := anypb.New(extAuthProto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &hcmv3.HttpFilter{
+		Name:     extAuthFilterName(route),
+		Disabled: true,
+		ConfigType: &hcmv3.HttpFilter_TypedConfig{
+			TypedConfig: extAuthAny,
+		},
+	}, nil
+}
+
+func extAuthFilterName(route *ir.HTTPRoute) string {
+	return perRouteFilterName(extAuthFilter, route.Name)
+}
+
+func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
+	config := &extauthv3.ExtAuthz{
+		TransportApiVersion: corev3.ApiVersion_V3,
+		FailureModeAllow:    false,
+	}
+
+	var headersToExtAuth []*matcherv3.StringMatcher
+	for _, header := range extAuth.HeadersToExtAuth {
+		headersToExtAuth = append(headersToExtAuth, &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_Exact{
+				Exact: header,
+			},
+		})
+	}
+
+	if len(headersToExtAuth) > 0 {
+		config.AllowedHeaders = &matcherv3.ListStringMatcher{
+			Patterns: headersToExtAuth,
+		}
+	}
+
+	if extAuth.HTTP != nil {
+		config.Services = &extauthv3.ExtAuthz_HttpService{
+			HttpService: httpService(extAuth.HTTP),
+		}
+	} else if extAuth.GRPC != nil {
+		config.Services = &extauthv3.ExtAuthz_GrpcService{
+			GrpcService: &corev3.GrpcService{
+				TargetSpecifier: &corev3.GrpcService_EnvoyGrpc_{
+					EnvoyGrpc: grpcService(extAuth.GRPC),
+				},
+				Timeout: &duration.Duration{
+					Seconds: defaultExtServiceRequestTimeout,
+				},
+			},
+		}
+	}
+
+	return config
+}
+
+func httpService(http *ir.HTTPExtAuthService) *extauthv3.HttpService {
+	var (
+		uri              string
+		headersToBackend []*matcherv3.StringMatcher
+		service          *extauthv3.HttpService
+	)
+
+	service = &extauthv3.HttpService{
+		PathPrefix: http.Path,
+	}
+
+	u := url.URL{
+		// scheme should be decided by the TLS setting, but we don't have that info now.
+		// It's safe to set it to http because the ext auth filter doesn't use the
+		// uri to make the request. It only uses the cluster.
+		Scheme: "http",
+		Host:   http.Authority,
+		Path:   http.Path,
+	}
+	uri = u.String()
+
+	service.ServerUri = &corev3.HttpUri{
+		Uri: uri,
+		HttpUpstreamType: &corev3.HttpUri_Cluster{
+			Cluster: http.Destination.Name,
+		},
+		Timeout: &duration.Duration{
+			Seconds: defaultExtServiceRequestTimeout,
+		},
+	}
+
+	for _, header := range http.HeadersToBackend {
+		headersToBackend = append(headersToBackend, &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_Exact{
+				Exact: header,
+			},
+		})
+	}
+
+	if len(headersToBackend) > 0 {
+		service.AuthorizationResponse = &extauthv3.AuthorizationResponse{
+			AllowedUpstreamHeaders: &matcherv3.ListStringMatcher{
+				Patterns: headersToBackend,
+			},
+		}
+	}
+
+	return service
+}
+
+func grpcService(grpc *ir.GRPCExtAuthService) *corev3.GrpcService_EnvoyGrpc {
+	return &corev3.GrpcService_EnvoyGrpc{
+		ClusterName: grpc.Destination.Name,
+		Authority:   grpc.Authority,
+	}
+}
+
+// routeContainsExtAuth returns true if ExtAuth exists for the provided route.
+func routeContainsExtAuth(irRoute *ir.HTTPRoute) bool {
+	if irRoute == nil {
+		return false
+	}
+
+	if irRoute != nil &&
+		irRoute.ExtAuth != nil {
+		return true
+	}
+
+	return false
+}
+
+// patchResources patches the cluster resources for the external auth services.
+func (*extAuth) patchResources(tCtx *types.ResourceVersionTable,
+	routes []*ir.HTTPRoute) error {
+	if tCtx == nil || tCtx.XdsResources == nil {
+		return errors.New("xds resource table is nil")
+	}
+
+	var errs error
+	for _, route := range routes {
+		if !routeContainsExtAuth(route) {
+			continue
+		}
+		if route.ExtAuth.HTTP != nil {
+			if err := createExtServiceXDSCluster(
+				&route.ExtAuth.HTTP.Destination, tCtx); err != nil && !errors.Is(
+				err, ErrXdsClusterExists) {
+				errs = errors.Join(errs, err)
+			}
+		} else {
+			if err := createExtServiceXDSCluster(
+				&route.ExtAuth.GRPC.Destination, tCtx); err != nil && !errors.Is(
+				err, ErrXdsClusterExists) {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+
+	return errs
+}
+
+func createExtServiceXDSCluster(rd *ir.RouteDestination, tCtx *types.ResourceVersionTable) error {
+	var (
+		endpointType EndpointType
+		tSocket      *corev3.TransportSocket
+		err          error
+	)
+
+	// Get the address type from the first setting.
+	// This is safe because no mixed address types in the settings.
+	addrTypeState := rd.Settings[0].AddressType
+	if addrTypeState != nil && *addrTypeState == ir.FQDN {
+		endpointType = EndpointTypeDNS
+	} else {
+		endpointType = EndpointTypeStatic
+	}
+
+	if rd.Settings[0].TLS != nil {
+		tSocket, err = processTLSSocket(rd.Settings[0].TLS, tCtx)
+		if err != nil {
+			return err
+		}
+	}
+
+	if err = addXdsCluster(tCtx, &xdsClusterArgs{
+		name:         rd.Name,
+		settings:     rd.Settings,
+		tSocket:      tSocket,
+		endpointType: endpointType,
+	}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+		return err
+	}
+	return nil
+}
+
+// patchRoute patches the provided route with the extAuth config if applicable.
+// Note: this method enables the corresponding extAuth filter for the provided route.
+func (*extAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+	if irRoute.ExtAuth == nil {
+		return nil
+	}
+	return enableFilterOnRoute(extAuthFilter, route, irRoute)
+}
diff --git a/adapter/internal/operator/gateway-api/translator/fault.go b/adapter/internal/operator/gateway-api/translator/fault.go
new file mode 100644
index 000000000..3e8858033
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/fault.go
@@ -0,0 +1,218 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	xdsfault "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/common/fault/v3"
+	xdshttpfaultv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/fault/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	xdstype "github.com/envoyproxy/go-control-plane/envoy/type/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/durationpb"
+)
+
+const (
+	faultFilter = "envoy.filters.http.fault"
+)
+
+func init() {
+	registerHTTPFilter(&fault{})
+}
+
+type fault struct {
+}
+
+var _ httpFilter = &fault{}
+
+// patchHCM builds and appends the fault Filters to the HTTP Connection Manager
+// if applicable, and it does not already exist.
+// Note: this method creates an fault filter for each route that contains an Fault config.
+func (*fault) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error {
+
+	if mgr == nil {
+		return errors.New("hcm is nil")
+	}
+
+	if irListener == nil {
+		return errors.New("ir listener is nil")
+	}
+
+	if !listenerContainsFault(irListener) {
+		return nil
+	}
+
+	// Return early if the fault filter already exists.
+	for _, existingFilter := range mgr.HttpFilters {
+		if existingFilter.Name == faultFilter {
+			return nil
+		}
+	}
+
+	faultFilter, err := buildHCMFaultFilter(irListener)
+	if err != nil {
+		return err
+	}
+	mgr.HttpFilters = append(mgr.HttpFilters, faultFilter)
+
+	return nil
+}
+
+// buildHCMFaultFilter returns a basic_auth HTTP filter from the provided IR HTTPRoute.
+func buildHCMFaultFilter(irListener *ir.HTTPListener) (*hcmv3.HttpFilter, error) {
+	faultProto := faultConfig(irListener)
+
+	if err := faultProto.ValidateAll(); err != nil {
+		return nil, err
+	}
+
+	faultAny, err := anypb.New(faultProto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &hcmv3.HttpFilter{
+		Name: faultFilter,
+		ConfigType: &hcmv3.HttpFilter_TypedConfig{
+			TypedConfig: faultAny,
+		},
+	}, nil
+}
+
+func faultConfig(irListener *ir.HTTPListener) *xdshttpfaultv3.HTTPFault {
+	return &xdshttpfaultv3.HTTPFault{}
+}
+
+// listenerContainsFault returns true if Fault exists for the provided listener.
+func listenerContainsFault(irListener *ir.HTTPListener) bool {
+	for _, route := range irListener.Routes {
+		if routeContainsFault(route) {
+			return true
+		}
+	}
+	return false
+}
+
+// routeContainsFault returns true if Fault exists for the provided route.
+func routeContainsFault(irRoute *ir.HTTPRoute) bool {
+	if irRoute == nil {
+		return false
+	}
+
+	if irRoute != nil &&
+		irRoute.FaultInjection != nil {
+		return true
+	}
+
+	return false
+}
+
+func (*fault) patchResources(*types.ResourceVersionTable, []*ir.HTTPRoute) error {
+	return nil
+}
+
+// patchRoute patches the provided route with the fault config if applicable.
+// Note: this method enables the corresponding fault filter for the provided route.
+func (*fault) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+	if irRoute.FaultInjection == nil {
+		return nil
+	}
+
+	filterCfg := route.GetTypedPerFilterConfig()
+	if _, ok := filterCfg[wellknown.Fault]; ok {
+		// This should not happen since this is the only place where the fault
+		// filter is added in a route.
+		return fmt.Errorf("route already contains fault config: %+v", route)
+	}
+
+	routeCfgProto := &xdshttpfaultv3.HTTPFault{}
+
+	if irRoute.FaultInjection.Delay != nil {
+		routeCfgProto.Delay = &xdsfault.FaultDelay{}
+		if irRoute.FaultInjection.Delay.Percentage != nil {
+			routeCfgProto.Delay.Percentage = translatePercentToFractionalPercent(irRoute.FaultInjection.Delay.Percentage)
+		}
+		if irRoute.FaultInjection.Delay.FixedDelay != nil {
+			routeCfgProto.Delay.FaultDelaySecifier = &xdsfault.FaultDelay_FixedDelay{
+				FixedDelay: durationpb.New(irRoute.FaultInjection.Delay.FixedDelay.Duration),
+			}
+		}
+	}
+
+	if irRoute.FaultInjection.Abort != nil {
+		routeCfgProto.Abort = &xdshttpfaultv3.FaultAbort{}
+		if irRoute.FaultInjection.Abort.Percentage != nil {
+			routeCfgProto.Abort.Percentage = translatePercentToFractionalPercent(irRoute.FaultInjection.Abort.Percentage)
+		}
+		if irRoute.FaultInjection.Abort.HTTPStatus != nil {
+			routeCfgProto.Abort.ErrorType = &xdshttpfaultv3.FaultAbort_HttpStatus{
+				HttpStatus: uint32(*irRoute.FaultInjection.Abort.HTTPStatus),
+			}
+		}
+		if irRoute.FaultInjection.Abort.GrpcStatus != nil {
+			routeCfgProto.Abort.ErrorType = &xdshttpfaultv3.FaultAbort_GrpcStatus{
+				GrpcStatus: uint32(*irRoute.FaultInjection.Abort.GrpcStatus),
+			}
+		}
+
+	}
+
+	if routeCfgProto.Delay == nil && routeCfgProto.Abort == nil {
+		return nil
+	}
+
+	routeCfgAny, err := anypb.New(routeCfgProto)
+	if err != nil {
+		return err
+	}
+
+	if filterCfg == nil {
+		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
+	}
+
+	route.TypedPerFilterConfig[wellknown.Fault] = routeCfgAny
+
+	return nil
+
+}
+
+// translatePercentToFractionalPercent translates an v1alpha3 Percent instance
+// to an envoy.type.FractionalPercent instance.
+func translatePercentToFractionalPercent(p *float32) *xdstype.FractionalPercent {
+	return &xdstype.FractionalPercent{
+		Numerator:   uint32(*p * 10000),
+		Denominator: xdstype.FractionalPercent_MILLION,
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/translator/httpfilters.go b/adapter/internal/operator/gateway-api/translator/httpfilters.go
new file mode 100644
index 000000000..5086dc891
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/httpfilters.go
@@ -0,0 +1,243 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"sort"
+	"strings"
+
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/filters"
+	"github.com/wso2/apk/adapter/internal/types"
+	"k8s.io/utils/ptr"
+)
+
+var httpFilters []httpFilter
+
+// registerHTTPFilter registers the provided HTTP filter.
+func registerHTTPFilter(filter httpFilter) {
+	httpFilters = append(httpFilters, filter)
+}
+
+// httpFilter is the interface for all the HTTP filters.
+//
+// There are two ways to support per-route configuration for an HTTP filter:
+// - For the filters with native per-route configuration support:
+//   - patchHCM: EG adds the filter to the HCM filter chain only once.
+//   - patchRoute: EG adds the filter's native per-route configuration to each
+//     route's typedFilterConfig.
+//
+// - For the filters without native per-route configuration support:
+//   - patchHCM: EG adds a filter for each route in the HCM filter chain, the
+//     filter name is prefixed with the filter's type name, for example,
+//     "envoy.filters.http.oauth2", and suffixed with the route name. Each filter
+//     is configured with the route's per-route configuration. The filter is
+//     disabled by default and is enabled on the route level.
+//   - PatchRouteWithPerRouteConfig: EG enables the corresponding filter for each
+//     route in the typedFilterConfig of that route.
+//
+// The filter types that haven't native per-route support: oauth2, basic authn, ext_authz.
+// Note: The filter types that have native per-route configuration support should
+// always se their own native per-route configuration.
+type httpFilter interface {
+	// patchHCM patches the HttpConnectionManager with the filter.
+	// Note: this method may be called multiple times for the same filter, please
+	// make sure to avoid duplicate additions of the same filter.
+	patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error
+
+	// patchRoute patches the provide Route with a filter's Route level configuration.
+	patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error
+
+	// patchResources adds all the other needed resources referenced by this
+	// filter to the resource version table.
+	// for example:
+	// - a jwt filter needs to add the cluster for the jwks.
+	// - an oidc filter needs to add the cluster for token endpoint and the secret
+	//   for the oauth2 client secret and the hmac secret.
+	patchResources(tCtx *types.ResourceVersionTable, routes []*ir.HTTPRoute) error
+}
+
+type OrderedHTTPFilter struct {
+	filter *hcmv3.HttpFilter
+	order  int
+}
+
+type OrderedHTTPFilters []*OrderedHTTPFilter
+
+// newOrderedHTTPFilter gives each HTTP filter a rational order.
+// This is needed because the order of the filters is important.
+// For example, the cors filter should be put at the first to avoid unnecessary
+// processing of other filters for unauthorized cross-region access.
+// The router filter must be the last one since it's a terminal filter.
+//
+// Important: please modify this method and set the order for the new filter
+// when adding a new filter in the HCM filter chain.
+// If the order is not explicitly specified in this method, a filter will be set
+// a default order 50.
+func newOrderedHTTPFilter(filter *hcmv3.HttpFilter) *OrderedHTTPFilter {
+	order := 50
+
+	// Set a rational order for all the filters.
+	switch {
+	case filter.Name == wellknown.CORS:
+		order = 1
+	case isFilterType(filter, extAuthFilter):
+		order = 2
+	case isFilterType(filter, basicAuthFilter):
+		order = 3
+	case isFilterType(filter, oauth2Filter):
+		order = 4
+	case filter.Name == wellknown.Fault:
+		order = 6
+	// case filter.Name == localRateLimitFilter:
+	// 	order = 7
+	case filter.Name == wellknown.HTTPRateLimit:
+		order = 8
+	case filter.Name == wellknown.Router:
+		order = 100
+	}
+
+	return &OrderedHTTPFilter{
+		filter: filter,
+		order:  order,
+	}
+}
+
+// sort.Interface implementation.
+
+func (o OrderedHTTPFilters) Len() int {
+	return len(o)
+}
+
+func (o OrderedHTTPFilters) Less(i, j int) bool {
+	return o[i].order < o[j].order
+}
+
+func (o OrderedHTTPFilters) Swap(i, j int) {
+	o[i], o[j] = o[j], o[i]
+}
+
+// sortHTTPFilters sorts the HTTP filters in the correct order.
+// This is needed because the order of the filters is important.
+// For example, the cors filter should be put at the first to avoid unnecessary
+// processing of other filters for unauthorized cross-region access.
+// The router filter must be the last one since it's a terminal filter.
+func sortHTTPFilters(filters []*hcmv3.HttpFilter) []*hcmv3.HttpFilter {
+	orderedFilters := make(OrderedHTTPFilters, len(filters))
+	for i := 0; i < len(filters); i++ {
+		orderedFilters[i] = newOrderedHTTPFilter(filters[i])
+	}
+	sort.Sort(orderedFilters)
+
+	for i := 0; i < len(filters); i++ {
+		filters[i] = orderedFilters[i].filter
+	}
+	return filters
+}
+
+// patchHCMWithFilters builds and appends HTTP Filters to the HTTP connection
+// manager.
+// Important: don't forget to set the order for newly added filters in the
+// newOrderedHTTPFilter method.
+func (t *Translator) patchHCMWithFilters(
+	mgr *hcmv3.HttpConnectionManager,
+	irListener *ir.HTTPListener) error {
+	// The order of filter patching is not relevant here.
+	// All the filters will be sorted in correct order after the patching is done.
+	//
+	// Important: don't forget to set the order for new filters in the
+	// newOrderedHTTPFilter method.
+	for _, filter := range httpFilters {
+		if err := filter.patchHCM(mgr, irListener); err != nil {
+			return err
+		}
+	}
+
+	// // RateLimit filter is handled separately because it relies on the global
+	// // rate limit server configuration.
+	// t.patchHCMWithRateLimit(mgr, irListener)
+
+	// Add the router filter if it doesn't exist.
+	hasRouter := false
+	for _, filter := range mgr.HttpFilters {
+		if filter.Name == wellknown.Router {
+			hasRouter = true
+			break
+		}
+	}
+	if !hasRouter {
+		headerSettings := ptr.Deref(irListener.Headers, ir.HeaderSettings{})
+		mgr.HttpFilters = append(mgr.HttpFilters, filters.GenerateRouterFilter(headerSettings.EnableEnvoyHeaders))
+	}
+
+	// Sort the filters in the correct order.
+	mgr.HttpFilters = sortHTTPFilters(mgr.HttpFilters)
+	return nil
+}
+
+// patchRouteWithPerRouteConfig appends per-route filter configuration to the
+// provided route.
+func patchRouteWithPerRouteConfig(
+	route *routev3.Route,
+	irRoute *ir.HTTPRoute) error {
+
+	for _, filter := range httpFilters {
+		if err := filter.patchRoute(route, irRoute); err != nil {
+			return err
+		}
+	}
+
+	// RateLimit filter is handled separately because it relies on the global
+	// rate limit server configuration.
+	// if err :=
+	// 	patchRouteWithRateLimit(route.GetRoute(), irRoute); err != nil {
+	// 	return nil
+	// }
+
+	return nil
+}
+
+// isFilterType returns true if the filter is the provided filter type.
+func isFilterType(filter *hcmv3.HttpFilter, filterType string) bool {
+	// Multiple filters of the same types are added to the HCM filter chain, one for each
+	// route. The filter name is prefixed with the filter type, for example:
+	// "envoy.filters.http.oauth2_first-route".
+	return strings.HasPrefix(filter.Name, filterType)
+}
+
+// patchResources adds all the other needed resources referenced by this
+// filter to the resource version table.
+// for example:
+// - a jwt filter needs to add the cluster for the jwks.
+// - an oidc filter needs to add the secret for the oauth2 client secret.
+func patchResources(tCtx *types.ResourceVersionTable, routes []*ir.HTTPRoute) error {
+	for _, filter := range httpFilters {
+		if err := filter.patchResources(tCtx, routes); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/listener.go b/adapter/internal/operator/gateway-api/translator/listener.go
new file mode 100644
index 000000000..49bd76dcc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/listener.go
@@ -0,0 +1,691 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+
+	xdscore "github.com/cncf/xds/go/xds/core/v3"
+	matcher "github.com/cncf/xds/go/xds/type/matcher/v3"
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	tls_inspectorv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/tls_inspector/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	tcpv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/tcp_proxy/v3"
+	udpv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/udp/udp_proxy/v3"
+	preservecasev3 "github.com/envoyproxy/go-control-plane/envoy/extensions/http/header_formatters/preserve_case/v3"
+	quicv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/quic/v3"
+	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/golang/protobuf/ptypes/wrappers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	xdsfilters "github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/filters"
+	"github.com/wso2/apk/adapter/pkg/utils/protocov"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-per-connection-buffer-limit-bytes
+	tcpListenerPerConnectionBufferLimitBytes = 32768
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-http2protocoloptions-max-concurrent-streams
+	http2MaxConcurrentStreamsLimit = 100
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-http2protocoloptions-initial-stream-window-size
+	http2InitialStreamWindowSize = 65536 // 64 KiB
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-http2protocoloptions-initial-connection-window-size
+	http2InitialConnectionWindowSize = 1048576 // 1 MiB
+)
+
+func http1ProtocolOptions(opts *ir.HTTP1Settings) *corev3.Http1ProtocolOptions {
+	if opts == nil {
+		return nil
+	}
+	if !opts.EnableTrailers && !opts.PreserveHeaderCase && opts.HTTP10 == nil {
+		return nil
+	}
+	// If PreserveHeaderCase is true and EnableTrailers is false then setting the EnableTrailers field to false
+	// is simply keeping it at its default value of "disabled".
+	r := &corev3.Http1ProtocolOptions{
+		EnableTrailers: opts.EnableTrailers,
+	}
+	if opts.PreserveHeaderCase {
+		preservecaseAny, _ := anypb.New(&preservecasev3.PreserveCaseFormatterConfig{})
+		r.HeaderKeyFormat = &corev3.Http1ProtocolOptions_HeaderKeyFormat{
+			HeaderFormat: &corev3.Http1ProtocolOptions_HeaderKeyFormat_StatefulFormatter{
+				StatefulFormatter: &corev3.TypedExtensionConfig{
+					Name:        "preserve_case",
+					TypedConfig: preservecaseAny,
+				},
+			},
+		}
+	}
+	if opts.HTTP10 != nil {
+		r.AcceptHttp_10 = true
+		r.DefaultHostForHttp_10 = ptr.Deref(opts.HTTP10.DefaultHost, "")
+	}
+	return r
+}
+
+func http2ProtocolOptions() *corev3.Http2ProtocolOptions {
+	return &corev3.Http2ProtocolOptions{
+		MaxConcurrentStreams: &wrappers.UInt32Value{
+			Value: http2MaxConcurrentStreamsLimit,
+		},
+		InitialStreamWindowSize: &wrappers.UInt32Value{
+			Value: http2InitialStreamWindowSize,
+		},
+		InitialConnectionWindowSize: &wrappers.UInt32Value{
+			Value: http2InitialConnectionWindowSize,
+		},
+	}
+}
+
+// func xffNumTrustedHops(clientIPDetection *ir.ClientIPDetectionSettings) uint32 {
+// 	if clientIPDetection != nil && clientIPDetection.XForwardedFor != nil && clientIPDetection.XForwardedFor.NumTrustedHops != nil {
+// 		return *clientIPDetection.XForwardedFor.NumTrustedHops
+// 	}
+// 	return 0
+// }
+
+// func originalIPDetectionExtensions(clientIPDetection *ir.ClientIPDetectionSettings) []*corev3.TypedExtensionConfig {
+// 	// Return early if settings are nil
+// 	if clientIPDetection == nil {
+// 		return nil
+// 	}
+
+// 	var extensionConfig []*corev3.TypedExtensionConfig
+
+// 	// Custom header extension
+// 	if clientIPDetection.CustomHeader != nil {
+// 		var rejectWithStatus *typev3.HttpStatus
+// 		if ptr.Deref(clientIPDetection.CustomHeader.FailClosed, false) {
+// 			rejectWithStatus = &typev3.HttpStatus{Code: typev3.StatusCode_Forbidden}
+// 		}
+
+// 		customHeaderConfigAny, _ := anypb.New(&customheaderv3.CustomHeaderConfig{
+// 			HeaderName:       clientIPDetection.CustomHeader.Name,
+// 			RejectWithStatus: rejectWithStatus,
+
+// 			AllowExtensionToSetAddressAsTrusted: true,
+// 		})
+
+// 		extensionConfig = append(extensionConfig, &corev3.TypedExtensionConfig{
+// 			Name:        "envoy.extensions.http.original_ip_detection.custom_header",
+// 			TypedConfig: customHeaderConfigAny,
+// 		})
+// 	}
+
+// 	return extensionConfig
+// }
+
+// buildXdsTCPListener creates a xds Listener resource
+// TODO: Improve function parameters
+func buildXdsTCPListener(name, address string, port uint32, keepalive *ir.TCPKeepalive, accesslog *ir.AccessLog) *listenerv3.Listener {
+	socketOptions := buildTCPSocketOptions(keepalive)
+	al := buildXdsAccessLog(accesslog, true)
+	return &listenerv3.Listener{
+		Name:                          name,
+		AccessLog:                     al,
+		SocketOptions:                 socketOptions,
+		PerConnectionBufferLimitBytes: wrapperspb.UInt32(tcpListenerPerConnectionBufferLimitBytes),
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Protocol: corev3.SocketAddress_TCP,
+					Address:  address,
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: port,
+					},
+				},
+			},
+		},
+		// Remove /healthcheck/fail from endpoints that trigger a drain of listeners for better control
+		// over the drain process while still allowing the healthcheck to be failed during pod shutdown.
+		DrainType: listenerv3.Listener_MODIFY_ONLY,
+	}
+}
+
+// buildXdsQuicListener creates a xds Listener resource for quic
+func buildXdsQuicListener(name, address string, port uint32, accesslog *ir.AccessLog) *listenerv3.Listener {
+	xdsListener := &listenerv3.Listener{
+		Name:      name + "-quic",
+		AccessLog: buildXdsAccessLog(accesslog, true),
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Protocol: corev3.SocketAddress_UDP,
+					Address:  address,
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: port,
+					},
+				},
+			},
+		},
+		UdpListenerConfig: &listenerv3.UdpListenerConfig{
+			DownstreamSocketConfig: &corev3.UdpSocketConfig{},
+			QuicOptions:            &listenerv3.QuicProtocolOptions{},
+		},
+		// Remove /healthcheck/fail from endpoints that trigger a drain of listeners for better control
+		// over the drain process while still allowing the healthcheck to be failed during pod shutdown.
+		DrainType: listenerv3.Listener_MODIFY_ONLY,
+	}
+
+	return xdsListener
+}
+
+func (t *Translator) addXdsHTTPFilterChain(xdsListener *listenerv3.Listener, irListener *ir.HTTPListener,
+	accesslog *ir.AccessLog, tracing *ir.Tracing, http3Listener bool) error {
+	al := buildXdsAccessLog(accesslog, false)
+
+	hcmTracing, err := buildHCMTracing(tracing)
+	if err != nil {
+		return err
+	}
+
+	// HTTP filter configuration
+	var statPrefix string
+	if irListener.TLS != nil {
+		statPrefix = "https"
+	} else {
+		statPrefix = "http"
+	}
+
+	// Client IP detection
+	var useRemoteAddress = true
+	// var originalIPDetectionExtensions = originalIPDetectionExtensions(irListener.ClientIPDetection)
+	// if originalIPDetectionExtensions != nil {
+	// 	useRemoteAddress = false
+	// }
+
+	mgr := &hcmv3.HttpConnectionManager{
+		AccessLog:  al,
+		CodecType:  hcmv3.HttpConnectionManager_AUTO,
+		StatPrefix: statPrefix,
+		RouteSpecifier: &hcmv3.HttpConnectionManager_Rds{
+			Rds: &hcmv3.Rds{
+				ConfigSource: makeConfigSource(),
+				// Configure route name to be found via RDS.
+				RouteConfigName: irListener.Name,
+			},
+		},
+		HttpProtocolOptions: http1ProtocolOptions(irListener.HTTP1),
+		// Hide the Envoy proxy in the Server header by default
+		ServerHeaderTransformation: hcmv3.HttpConnectionManager_PASS_THROUGH,
+		// Add HTTP2 protocol options
+		// Set it by default to also support HTTP1.1 to HTTP2 Upgrades
+		Http2ProtocolOptions: http2ProtocolOptions(),
+		// https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-for
+		UseRemoteAddress: &wrappers.BoolValue{Value: useRemoteAddress},
+		// XffNumTrustedHops:             xffNumTrustedHops(irListener.ClientIPDetection),
+		// OriginalIpDetectionExtensions: originalIPDetectionExtensions,
+		// normalize paths according to RFC 3986
+		NormalizePath: &wrapperspb.BoolValue{Value: true},
+		MergeSlashes:  irListener.Path.MergeSlashes,
+		// PathWithEscapedSlashesAction: translateEscapePath(irListener.Path.EscapedSlashesAction),
+		CommonHttpProtocolOptions: &corev3.HttpProtocolOptions{
+			HeadersWithUnderscoresAction: corev3.HttpProtocolOptions_REJECT_REQUEST,
+		},
+		Tracing: hcmTracing,
+	}
+
+	if irListener.Timeout != nil && irListener.Timeout.HTTP != nil && irListener.Timeout.HTTP.RequestReceivedTimeout != nil {
+		mgr.RequestTimeout = durationpb.New(irListener.Timeout.HTTP.RequestReceivedTimeout.Duration)
+	}
+
+	// Add the proxy protocol filter if needed
+	patchProxyProtocolFilter(xdsListener, irListener)
+
+	if irListener.IsHTTP2 {
+		mgr.HttpFilters = append(mgr.HttpFilters, xdsfilters.GRPCWeb)
+		// always enable grpc stats filter
+		mgr.HttpFilters = append(mgr.HttpFilters, xdsfilters.GRPCStats)
+	}
+
+	if http3Listener {
+		mgr.CodecType = hcmv3.HttpConnectionManager_HTTP3
+		mgr.Http3ProtocolOptions = &corev3.Http3ProtocolOptions{}
+	}
+	// Add HTTP filters to the HCM, the filters have already been sorted in the
+	// correct order in the patchHCMWithFilters function.
+	if err := t.patchHCMWithFilters(mgr, irListener); err != nil {
+		return err
+	}
+
+	mgrAny, err := protocov.ToAnyWithError(mgr)
+	if err != nil {
+		return err
+	}
+
+	filterChain := &listenerv3.FilterChain{
+		Filters: []*listenerv3.Filter{{
+			Name: wellknown.HTTPConnectionManager,
+			ConfigType: &listenerv3.Filter_TypedConfig{
+				TypedConfig: mgrAny,
+			},
+		}},
+	}
+
+	if irListener.TLS != nil {
+		var tSocket *corev3.TransportSocket
+		if http3Listener {
+			tSocket, err = buildDownstreamQUICTransportSocket(irListener.TLS, http3Listener)
+			if err != nil {
+				return err
+			}
+		} else {
+			tSocket, err = buildXdsDownstreamTLSSocket(irListener.TLS, http3Listener)
+			if err != nil {
+				return err
+			}
+		}
+		filterChain.TransportSocket = tSocket
+		if err := addServerNamesMatch(xdsListener, filterChain, irListener.Hostnames); err != nil {
+			return err
+		}
+
+		xdsListener.FilterChains = append(xdsListener.FilterChains, filterChain)
+	} else {
+		// Add the HTTP filter chain as the default filter chain
+		// Make sure one does not exist
+		if xdsListener.DefaultFilterChain != nil {
+			return errors.New("default filter chain already exists")
+		}
+		xdsListener.DefaultFilterChain = filterChain
+	}
+
+	return nil
+}
+
+func addServerNamesMatch(xdsListener *listenerv3.Listener, filterChain *listenerv3.FilterChain, hostnames []string) error {
+	// Dont add a filter chain match if the hostname is a wildcard character.
+	if len(hostnames) > 0 && hostnames[0] != "*" {
+		filterChain.FilterChainMatch = &listenerv3.FilterChainMatch{
+			ServerNames: hostnames,
+		}
+
+		if err := addXdsTLSInspectorFilter(xdsListener); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// findXdsHTTPRouteConfigName finds the name of the route config associated with the
+// http connection manager within the default filter chain and returns an empty string if
+// not found.
+func findXdsHTTPRouteConfigName(xdsListener *listenerv3.Listener) string {
+	if xdsListener == nil || xdsListener.DefaultFilterChain == nil || xdsListener.DefaultFilterChain.Filters == nil {
+		return ""
+	}
+
+	for _, filter := range xdsListener.DefaultFilterChain.Filters {
+		if filter.Name == wellknown.HTTPConnectionManager {
+			m := new(hcmv3.HttpConnectionManager)
+			if err := filter.GetTypedConfig().UnmarshalTo(m); err != nil {
+				return ""
+			}
+			rds := m.GetRds()
+			if rds == nil {
+				return ""
+			}
+			return rds.GetRouteConfigName()
+		}
+	}
+	return ""
+}
+
+func addXdsTCPFilterChain(xdsListener *listenerv3.Listener, irListener *ir.TCPListener, clusterName string, accesslog *ir.AccessLog) error {
+	if irListener == nil {
+		return errors.New("tcp listener is nil")
+	}
+
+	isTLSPassthrough := irListener.TLS != nil && irListener.TLS.Passthrough != nil
+	isTLSTerminate := irListener.TLS != nil && irListener.TLS.Terminate != nil
+	statPrefix := "tcp"
+	if isTLSPassthrough {
+		statPrefix = "passthrough"
+	}
+
+	if isTLSTerminate {
+		statPrefix = "terminate"
+	}
+
+	mgr := &tcpv3.TcpProxy{
+		AccessLog:  buildXdsAccessLog(accesslog, false),
+		StatPrefix: statPrefix,
+		ClusterSpecifier: &tcpv3.TcpProxy_Cluster{
+			Cluster: clusterName,
+		},
+	}
+	mgrAny, err := anypb.New(mgr)
+	if err != nil {
+		return err
+	}
+
+	filterChain := &listenerv3.FilterChain{
+		Filters: []*listenerv3.Filter{{
+			Name: wellknown.TCPProxy,
+			ConfigType: &listenerv3.Filter_TypedConfig{
+				TypedConfig: mgrAny,
+			},
+		}},
+	}
+
+	if isTLSPassthrough {
+		if err := addServerNamesMatch(xdsListener, filterChain, irListener.TLS.Passthrough.SNIs); err != nil {
+			return err
+		}
+	}
+
+	if isTLSTerminate {
+		tSocket, err := buildXdsDownstreamTLSSocket(irListener.TLS.Terminate, false)
+		if err != nil {
+			return err
+		}
+		filterChain.TransportSocket = tSocket
+	}
+
+	xdsListener.FilterChains = append(xdsListener.FilterChains, filterChain)
+
+	return nil
+}
+
+// addXdsTLSInspectorFilter adds a Tls Inspector filter if it does not yet exist.
+func addXdsTLSInspectorFilter(xdsListener *listenerv3.Listener) error {
+	// Return early if it exists
+	for _, filter := range xdsListener.ListenerFilters {
+		if filter.Name == wellknown.TlsInspector {
+			return nil
+		}
+	}
+
+	tlsInspector := &tls_inspectorv3.TlsInspector{}
+	tlsInspectorAny, err := anypb.New(tlsInspector)
+	if err != nil {
+		return err
+	}
+
+	filter := &listenerv3.ListenerFilter{
+		Name: wellknown.TlsInspector,
+		ConfigType: &listenerv3.ListenerFilter_TypedConfig{
+			TypedConfig: tlsInspectorAny,
+		},
+	}
+
+	xdsListener.ListenerFilters = append(xdsListener.ListenerFilters, filter)
+
+	return nil
+}
+
+func buildDownstreamQUICTransportSocket(tlsConfig *ir.TLSConfig, http3Listener bool) (*corev3.TransportSocket, error) {
+	tlsCtx := &quicv3.QuicDownstreamTransport{
+		DownstreamTlsContext: &tlsv3.DownstreamTlsContext{
+			CommonTlsContext: &tlsv3.CommonTlsContext{
+				TlsParams:     buildTLSParams(tlsConfig),
+				AlpnProtocols: buildALPNProtocols(tlsConfig.ALPNProtocols, http3Listener),
+			},
+		},
+	}
+
+	for _, tlsConfig := range tlsConfig.Certificates {
+		tlsCtx.DownstreamTlsContext.CommonTlsContext.TlsCertificateSdsSecretConfigs = append(
+			tlsCtx.DownstreamTlsContext.CommonTlsContext.TlsCertificateSdsSecretConfigs,
+			&tlsv3.SdsSecretConfig{
+				Name:      tlsConfig.Name,
+				SdsConfig: makeConfigSource(),
+			})
+	}
+
+	if tlsConfig.CACertificate != nil {
+		tlsCtx.DownstreamTlsContext.RequireClientCertificate = &wrappers.BoolValue{Value: true}
+		tlsCtx.DownstreamTlsContext.CommonTlsContext.ValidationContextType = &tlsv3.CommonTlsContext_ValidationContextSdsSecretConfig{
+			ValidationContextSdsSecretConfig: &tlsv3.SdsSecretConfig{
+				Name:      tlsConfig.CACertificate.Name,
+				SdsConfig: makeConfigSource(),
+			},
+		}
+	}
+
+	tlsCtxAny, err := anypb.New(tlsCtx)
+	if err != nil {
+		return nil, err
+	}
+	return &corev3.TransportSocket{
+		Name: wellknown.TransportSocketQuic,
+		ConfigType: &corev3.TransportSocket_TypedConfig{
+			TypedConfig: tlsCtxAny,
+		},
+	}, nil
+}
+
+func buildXdsDownstreamTLSSocket(tlsConfig *ir.TLSConfig, http3Listener bool) (*corev3.TransportSocket, error) {
+	tlsCtx := &tlsv3.DownstreamTlsContext{
+		CommonTlsContext: &tlsv3.CommonTlsContext{
+			TlsParams:                      buildTLSParams(tlsConfig),
+			AlpnProtocols:                  buildALPNProtocols(tlsConfig.ALPNProtocols, http3Listener),
+			TlsCertificateSdsSecretConfigs: []*tlsv3.SdsSecretConfig{},
+		},
+	}
+
+	for _, tlsConfig := range tlsConfig.Certificates {
+		tlsCtx.CommonTlsContext.TlsCertificateSdsSecretConfigs = append(
+			tlsCtx.CommonTlsContext.TlsCertificateSdsSecretConfigs,
+			&tlsv3.SdsSecretConfig{
+				Name:      tlsConfig.Name,
+				SdsConfig: makeConfigSource(),
+			})
+	}
+
+	if tlsConfig.CACertificate != nil {
+		tlsCtx.RequireClientCertificate = &wrappers.BoolValue{Value: true}
+		tlsCtx.CommonTlsContext.ValidationContextType = &tlsv3.CommonTlsContext_ValidationContextSdsSecretConfig{
+			ValidationContextSdsSecretConfig: &tlsv3.SdsSecretConfig{
+				Name:      tlsConfig.CACertificate.Name,
+				SdsConfig: makeConfigSource(),
+			},
+		}
+	}
+
+	tlsCtxAny, err := anypb.New(tlsCtx)
+	if err != nil {
+		return nil, err
+	}
+
+	return &corev3.TransportSocket{
+		Name: wellknown.TransportSocketTls,
+		ConfigType: &corev3.TransportSocket_TypedConfig{
+			TypedConfig: tlsCtxAny,
+		},
+	}, nil
+}
+
+func buildTLSParams(tlsConfig *ir.TLSConfig) *tlsv3.TlsParameters {
+	p := &tlsv3.TlsParameters{}
+	isEmpty := true
+	if tlsConfig.MinVersion != nil {
+		p.TlsMinimumProtocolVersion = buildTLSVersion(tlsConfig.MinVersion)
+		isEmpty = false
+	}
+	if tlsConfig.MaxVersion != nil {
+		p.TlsMaximumProtocolVersion = buildTLSVersion(tlsConfig.MaxVersion)
+		isEmpty = false
+	}
+	if len(tlsConfig.Ciphers) > 0 {
+		p.CipherSuites = tlsConfig.Ciphers
+		isEmpty = false
+	}
+	if len(tlsConfig.ECDHCurves) > 0 {
+		p.EcdhCurves = tlsConfig.ECDHCurves
+		isEmpty = false
+	}
+	if len(tlsConfig.SignatureAlgorithms) > 0 {
+		p.SignatureAlgorithms = tlsConfig.SignatureAlgorithms
+		isEmpty = false
+	}
+	if isEmpty {
+		return nil
+	}
+	return p
+}
+
+func buildTLSVersion(version *ir.TLSVersion) tlsv3.TlsParameters_TlsProtocol {
+	lookup := map[ir.TLSVersion]tlsv3.TlsParameters_TlsProtocol{
+		ir.TLSv10: tlsv3.TlsParameters_TLSv1_0,
+		ir.TLSv11: tlsv3.TlsParameters_TLSv1_1,
+		ir.TLSv12: tlsv3.TlsParameters_TLSv1_2,
+		ir.TLSv13: tlsv3.TlsParameters_TLSv1_3,
+	}
+	if r, found := lookup[*version]; found {
+		return r
+	}
+	return tlsv3.TlsParameters_TLS_AUTO
+}
+
+func buildALPNProtocols(alpn []string, http3Listener bool) []string {
+	if len(alpn) == 0 {
+		out := []string{"h2", "http/1.1"}
+		if http3Listener {
+			out = append(out, "h3")
+		}
+		return out
+	}
+	return alpn
+}
+
+func buildXdsTLSCertSecret(tlsConfig ir.TLSCertificate) *tlsv3.Secret {
+	return &tlsv3.Secret{
+		Name: tlsConfig.Name,
+		Type: &tlsv3.Secret_TlsCertificate{
+			TlsCertificate: &tlsv3.TlsCertificate{
+				CertificateChain: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{InlineBytes: tlsConfig.ServerCertificate},
+				},
+				PrivateKey: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{InlineBytes: tlsConfig.PrivateKey},
+				},
+			},
+		},
+	}
+}
+
+func buildXdsTLSCaCertSecret(caCertificate *ir.TLSCACertificate) *tlsv3.Secret {
+	return &tlsv3.Secret{
+		Name: caCertificate.Name,
+		Type: &tlsv3.Secret_ValidationContext{
+			ValidationContext: &tlsv3.CertificateValidationContext{
+				TrustedCa: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{InlineBytes: caCertificate.Certificate},
+				},
+			},
+		},
+	}
+}
+
+func buildXdsUDPListener(clusterName string, udpListener *ir.UDPListener, accesslog *ir.AccessLog) (*listenerv3.Listener, error) {
+	if udpListener == nil {
+		return nil, errors.New("udp listener is nil")
+	}
+
+	statPrefix := "service"
+
+	route := &udpv3.Route{
+		Cluster: clusterName,
+	}
+	routeAny, err := anypb.New(route)
+	if err != nil {
+		return nil, err
+	}
+
+	udpProxy := &udpv3.UdpProxyConfig{
+		StatPrefix: statPrefix,
+		AccessLog:  buildXdsAccessLog(accesslog, false),
+		RouteSpecifier: &udpv3.UdpProxyConfig_Matcher{
+			Matcher: &matcher.Matcher{
+				OnNoMatch: &matcher.Matcher_OnMatch{
+					OnMatch: &matcher.Matcher_OnMatch_Action{
+						Action: &xdscore.TypedExtensionConfig{
+							Name:        "route",
+							TypedConfig: routeAny,
+						},
+					},
+				},
+			},
+		},
+	}
+	udpProxyAny, err := anypb.New(udpProxy)
+	if err != nil {
+		return nil, err
+	}
+
+	xdsListener := &listenerv3.Listener{
+		Name:      udpListener.Name,
+		AccessLog: buildXdsAccessLog(accesslog, true),
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Protocol: corev3.SocketAddress_UDP,
+					Address:  udpListener.Address,
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: udpListener.Port,
+					},
+				},
+			},
+		},
+		ListenerFilters: []*listenerv3.ListenerFilter{{
+			Name: "envoy.filters.udp_listener.udp_proxy",
+			ConfigType: &listenerv3.ListenerFilter_TypedConfig{
+				TypedConfig: udpProxyAny,
+			},
+		}},
+	}
+
+	return xdsListener, nil
+}
+
+// Point to xds cluster.
+func makeConfigSource() *corev3.ConfigSource {
+	source := &corev3.ConfigSource{}
+	source.ResourceApiVersion = resource.DefaultAPIVersion
+	source.ConfigSourceSpecifier = &corev3.ConfigSource_Ads{
+		Ads: &corev3.AggregatedConfigSource{},
+	}
+	return source
+}
+
+// func translateEscapePath(in ir.PathEscapedSlashAction) hcmv3.HttpConnectionManager_PathWithEscapedSlashesAction {
+
+// 	lookup := map[ir.PathEscapedSlashAction]hcmv3.HttpConnectionManager_PathWithEscapedSlashesAction{
+// 		ir.KeepUnchangedAction: hcmv3.HttpConnectionManager_KEEP_UNCHANGED,
+// 		ir.RejectRequestAction: hcmv3.HttpConnectionManager_REJECT_REQUEST,
+// 		ir.UnescapeAndRedirect: hcmv3.HttpConnectionManager_UNESCAPE_AND_REDIRECT,
+// 		ir.UnescapeAndForward:  hcmv3.HttpConnectionManager_UNESCAPE_AND_FORWARD,
+// 	}
+// 	if r, found := lookup[in]; found {
+// 		return r
+// 	}
+// 	return hcmv3.HttpConnectionManager_IMPLEMENTATION_SPECIFIC_DEFAULT
+// }
diff --git a/adapter/internal/operator/gateway-api/translator/oidc.go b/adapter/internal/operator/gateway-api/translator/oidc.go
new file mode 100644
index 000000000..08d87017f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/oidc.go
@@ -0,0 +1,392 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	oauth2v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/oauth2/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/golang/protobuf/ptypes/duration"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"google.golang.org/protobuf/types/known/anypb"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	oauth2Filter     = "envoy.filters.http.oauth2"
+	envoyTrustBundle = "/etc/ssl/certs/ca-certificates.crt"
+)
+
+func init() {
+	registerHTTPFilter(&oidc{})
+}
+
+type oidc struct {
+}
+
+var _ httpFilter = &oidc{}
+
+// patchHCM builds and appends the oauth2 Filters to the HTTP Connection Manager
+// if applicable, and it does not already exist.
+// Note: this method creates an oauth2 filter for each route that contains an OIDC config.
+// the filter is disabled by default. It is enabled on the route level.
+func (*oidc) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error {
+	var errs error
+
+	if mgr == nil {
+		return errors.New("hcm is nil")
+	}
+
+	if irListener == nil {
+		return errors.New("ir listener is nil")
+	}
+
+	for _, route := range irListener.Routes {
+		if !routeContainsOIDC(route) {
+			continue
+		}
+
+		filter, err := buildHCMOAuth2Filter(route)
+		if err != nil {
+			errs = errors.Join(errs, err)
+			continue
+		}
+
+		mgr.HttpFilters = append(mgr.HttpFilters, filter)
+	}
+
+	return errs
+}
+
+// buildHCMOAuth2Filter returns an OAuth2 HTTP filter from the provided IR HTTPRoute.
+func buildHCMOAuth2Filter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
+	oauth2Proto, err := oauth2Config(route)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := oauth2Proto.ValidateAll(); err != nil {
+		return nil, err
+	}
+
+	OAuth2Any, err := anypb.New(oauth2Proto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &hcmv3.HttpFilter{
+		Name:     oauth2FilterName(route),
+		Disabled: true,
+		ConfigType: &hcmv3.HttpFilter_TypedConfig{
+			TypedConfig: OAuth2Any,
+		},
+	}, nil
+}
+
+func oauth2FilterName(route *ir.HTTPRoute) string {
+	return fmt.Sprintf("%s_%s", oauth2Filter, route.Name)
+}
+
+func oauth2Config(route *ir.HTTPRoute) (*oauth2v3.OAuth2, error) {
+	cluster, err := url2Cluster(route.OIDC.Provider.TokenEndpoint)
+	if err != nil {
+		return nil, err
+	}
+	if cluster.endpointType == EndpointTypeStatic {
+		return nil, fmt.Errorf(
+			"static IP cluster is not allowed: %s",
+			route.OIDC.Provider.TokenEndpoint)
+	}
+
+	oauth2 := &oauth2v3.OAuth2{
+		Config: &oauth2v3.OAuth2Config{
+			TokenEndpoint: &corev3.HttpUri{
+				Uri: route.OIDC.Provider.TokenEndpoint,
+				HttpUpstreamType: &corev3.HttpUri_Cluster{
+					Cluster: cluster.name,
+				},
+				Timeout: &duration.Duration{
+					Seconds: defaultExtServiceRequestTimeout,
+				},
+			},
+			AuthorizationEndpoint: route.OIDC.Provider.AuthorizationEndpoint,
+			RedirectUri:           route.OIDC.RedirectURL,
+			RedirectPathMatcher: &matcherv3.PathMatcher{
+				Rule: &matcherv3.PathMatcher_Path{
+					Path: &matcherv3.StringMatcher{
+						MatchPattern: &matcherv3.StringMatcher_Exact{
+							Exact: route.OIDC.RedirectPath,
+						},
+					},
+				},
+			},
+			SignoutPath: &matcherv3.PathMatcher{
+				Rule: &matcherv3.PathMatcher_Path{
+					Path: &matcherv3.StringMatcher{
+						MatchPattern: &matcherv3.StringMatcher_Exact{
+							Exact: route.OIDC.LogoutPath,
+						},
+					},
+				},
+			},
+			ForwardBearerToken: true,
+			Credentials: &oauth2v3.OAuth2Credentials{
+				ClientId: route.OIDC.ClientID,
+				TokenSecret: &tlsv3.SdsSecretConfig{
+					Name:      oauth2ClientSecretName(route),
+					SdsConfig: makeConfigSource(),
+				},
+				TokenFormation: &oauth2v3.OAuth2Credentials_HmacSecret{
+					HmacSecret: &tlsv3.SdsSecretConfig{
+						Name:      oauth2HMACSecretName(route),
+						SdsConfig: makeConfigSource(),
+					},
+				},
+				CookieNames: &oauth2v3.OAuth2Credentials_CookieNames{
+					BearerToken:  fmt.Sprintf("BearerToken-%s", route.OIDC.CookieSuffix),
+					OauthHmac:    fmt.Sprintf("OauthHMAC-%s", route.OIDC.CookieSuffix),
+					OauthExpires: fmt.Sprintf("OauthExpires-%s", route.OIDC.CookieSuffix),
+					IdToken:      fmt.Sprintf("IdToken-%s", route.OIDC.CookieSuffix),
+					RefreshToken: fmt.Sprintf("RefreshToken-%s", route.OIDC.CookieSuffix),
+				},
+			},
+			// every OIDC provider supports basic auth
+			AuthType:   oauth2v3.OAuth2Config_BASIC_AUTH,
+			AuthScopes: route.OIDC.Scopes,
+		},
+	}
+	return oauth2, nil
+}
+
+// routeContainsOIDC returns true if OIDC exists for the provided route.
+func routeContainsOIDC(irRoute *ir.HTTPRoute) bool {
+	if irRoute == nil {
+		return false
+	}
+
+	if irRoute != nil &&
+		irRoute.OIDC != nil {
+		return true
+	}
+
+	return false
+}
+
+func (*oidc) patchResources(tCtx *types.ResourceVersionTable,
+	routes []*ir.HTTPRoute) error {
+	if err := createOAuth2TokenEndpointClusters(tCtx, routes); err != nil {
+		return err
+	}
+	return createOAuth2Secrets(tCtx, routes)
+}
+
+// createOAuth2TokenEndpointClusters creates token endpoint clusters from the
+// provided routes, if needed.
+func createOAuth2TokenEndpointClusters(tCtx *types.ResourceVersionTable,
+	routes []*ir.HTTPRoute) error {
+	if tCtx == nil || tCtx.XdsResources == nil {
+		return errors.New("xds resource table is nil")
+	}
+
+	var errs error
+	for _, route := range routes {
+		if !routeContainsOIDC(route) {
+			continue
+		}
+
+		var (
+			cluster *urlCluster
+			ds      *ir.DestinationSetting
+			tSocket *corev3.TransportSocket
+			err     error
+		)
+
+		cluster, err = url2Cluster(route.OIDC.Provider.TokenEndpoint)
+		if err != nil {
+			errs = errors.Join(errs, err)
+			continue
+		}
+
+		// EG does not support static IP clusters for token endpoint clusters.
+		// This validation could be removed since it's already validated in the
+		// Gateway API translator.
+		if cluster.endpointType == EndpointTypeStatic {
+			errs = errors.Join(errs, fmt.Errorf(
+				"static IP cluster is not allowed: %s",
+				route.OIDC.Provider.TokenEndpoint))
+			continue
+		}
+
+		ds = &ir.DestinationSetting{
+			Weight: ptr.To[uint32](1),
+			Endpoints: []*ir.DestinationEndpoint{ir.NewDestEndpoint(
+				cluster.hostname,
+				cluster.port),
+			},
+		}
+
+		clusterArgs := &xdsClusterArgs{
+			name:         cluster.name,
+			settings:     []*ir.DestinationSetting{ds},
+			tSocket:      tSocket,
+			endpointType: cluster.endpointType,
+		}
+		if cluster.tls {
+			tSocket, err = buildXdsUpstreamTLSSocket(cluster.hostname)
+			if err != nil {
+				errs = errors.Join(errs, err)
+				continue
+			}
+			clusterArgs.tSocket = tSocket
+		}
+
+		if err = addXdsCluster(tCtx, clusterArgs); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// createOAuth2Secrets creates OAuth2 client and HMAC secrets from the provided
+// routes, if needed.
+func createOAuth2Secrets(tCtx *types.ResourceVersionTable, routes []*ir.HTTPRoute) error {
+	var errs error
+
+	for _, route := range routes {
+		if !routeContainsOIDC(route) {
+			continue
+		}
+
+		// a separate secret is created for each route, even they share the same
+		// oauth2 client ID and secret.
+		clientSecret := buildOAuth2ClientSecret(route)
+		if err := addXdsSecret(tCtx, clientSecret); err != nil {
+			errs = errors.Join(errs, err)
+		}
+
+		if err := addXdsSecret(tCtx, buildOAuth2HMACSecret(route)); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+func buildOAuth2ClientSecret(route *ir.HTTPRoute) *tlsv3.Secret {
+	clientSecret := &tlsv3.Secret{
+		Name: oauth2ClientSecretName(route),
+		Type: &tlsv3.Secret_GenericSecret{
+			GenericSecret: &tlsv3.GenericSecret{
+				Secret: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{
+						InlineBytes: route.OIDC.ClientSecret,
+					},
+				},
+			},
+		},
+	}
+
+	return clientSecret
+}
+
+func buildOAuth2HMACSecret(route *ir.HTTPRoute) *tlsv3.Secret {
+	hmacSecret := &tlsv3.Secret{
+		Name: oauth2HMACSecretName(route),
+		Type: &tlsv3.Secret_GenericSecret{
+			GenericSecret: &tlsv3.GenericSecret{
+				Secret: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{
+						InlineBytes: route.OIDC.HMACSecret,
+					},
+				},
+			},
+		},
+	}
+
+	return hmacSecret
+}
+
+func oauth2ClientSecretName(route *ir.HTTPRoute) string {
+	return fmt.Sprintf("%s/oauth2/client_secret", route.Name)
+}
+
+func oauth2HMACSecretName(route *ir.HTTPRoute) string {
+	return fmt.Sprintf("%s/oauth2/hmac_secret", route.Name)
+}
+
+// patchRoute patches the provided route with the oauth2 config if applicable.
+// Note: this method enables the corresponding oauth2 filter for the provided route.
+func (*oidc) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+	if irRoute.OIDC == nil {
+		return nil
+	}
+
+	return enableFilterOnRoute(oauth2Filter, route, irRoute)
+}
+
+// buildXdsUpstreamTLSSocket returns an xDS TransportSocket that uses envoyTrustBundle
+// as the CA to authenticate server certificates.
+// TODO huabing: add support for custom CA and client certificate.
+func buildXdsUpstreamTLSSocket(sni string) (*corev3.TransportSocket, error) {
+	tlsCtxProto := &tlsv3.UpstreamTlsContext{
+		Sni: sni,
+		CommonTlsContext: &tlsv3.CommonTlsContext{
+			ValidationContextType: &tlsv3.CommonTlsContext_ValidationContext{
+				ValidationContext: &tlsv3.CertificateValidationContext{
+					TrustedCa: &corev3.DataSource{
+						Specifier: &corev3.DataSource_Filename{
+							Filename: envoyTrustBundle,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	tlsCtxAny, err := anypb.New(tlsCtxProto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &corev3.TransportSocket{
+		Name: wellknown.TransportSocketTls,
+		ConfigType: &corev3.TransportSocket_TypedConfig{
+			TypedConfig: tlsCtxAny,
+		},
+	}, nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/proxy_protocol.go b/adapter/internal/operator/gateway-api/translator/proxy_protocol.go
new file mode 100644
index 000000000..99f529cf7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/proxy_protocol.go
@@ -0,0 +1,70 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	proxyprotocolv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/proxy_protocol/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+// patchProxyProtocolFilter builds and appends the Proxy Protocol Filter to the
+// HTTP Listener's Listener Filters if applicable.
+func patchProxyProtocolFilter(xdsListener *listenerv3.Listener, irListener *ir.HTTPListener) {
+	// Return early if unset
+	if xdsListener == nil || irListener == nil || !irListener.EnableProxyProtocol {
+		return
+	}
+
+	// Return early if filter already exists.
+	for _, filter := range xdsListener.ListenerFilters {
+		if filter.Name == wellknown.ProxyProtocol {
+			return
+		}
+	}
+
+	proxyProtocolFilter := buildProxyProtocolFilter()
+
+	if proxyProtocolFilter != nil {
+		xdsListener.ListenerFilters = append(xdsListener.ListenerFilters, proxyProtocolFilter)
+	}
+}
+
+// buildProxypProtocolFilter returns a Proxy Protocol listener filter from the provided IR listener.
+func buildProxyProtocolFilter() *listenerv3.ListenerFilter {
+	pp := &proxyprotocolv3.ProxyProtocol{}
+
+	ppAny, err := anypb.New(pp)
+	if err != nil {
+		return nil
+	}
+
+	return &listenerv3.ListenerFilter{
+		Name: wellknown.ProxyProtocol,
+		ConfigType: &listenerv3.ListenerFilter_TypedConfig{
+			TypedConfig: ppAny,
+		},
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/translator/route.go b/adapter/internal/operator/gateway-api/translator/route.go
new file mode 100644
index 000000000..d0ee7873a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/route.go
@@ -0,0 +1,585 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"strings"
+	"time"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	previoushost "github.com/envoyproxy/go-control-plane/envoy/extensions/retry/host/previous_hosts/v3"
+	matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/pkg/utils/protocov"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+)
+
+const (
+	retryDefaultRetryOn             = "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes"
+	retryDefaultRetriableStatusCode = 503
+	retryDefaultNumRetries          = 2
+)
+
+func buildXdsRoute(httpRoute *ir.HTTPRoute) (*routev3.Route, error) {
+	router := &routev3.Route{
+		Name:  httpRoute.Name,
+		Match: buildXdsRouteMatch(httpRoute.PathMatch, httpRoute.HeaderMatches, httpRoute.QueryParamMatches),
+	}
+
+	if len(httpRoute.AddRequestHeaders) > 0 {
+		router.RequestHeadersToAdd = buildXdsAddedHeaders(httpRoute.AddRequestHeaders)
+	}
+	if len(httpRoute.RemoveRequestHeaders) > 0 {
+		router.RequestHeadersToRemove = httpRoute.RemoveRequestHeaders
+	}
+
+	if len(httpRoute.AddResponseHeaders) > 0 {
+		router.ResponseHeadersToAdd = buildXdsAddedHeaders(httpRoute.AddResponseHeaders)
+	}
+	if len(httpRoute.RemoveResponseHeaders) > 0 {
+		router.ResponseHeadersToRemove = httpRoute.RemoveResponseHeaders
+	}
+
+	switch {
+	case httpRoute.DirectResponse != nil:
+		router.Action = &routev3.Route_DirectResponse{DirectResponse: buildXdsDirectResponseAction(httpRoute.DirectResponse)}
+	case httpRoute.Redirect != nil:
+		router.Action = &routev3.Route_Redirect{Redirect: buildXdsRedirectAction(httpRoute)}
+	case httpRoute.URLRewrite != nil:
+		routeAction := buildXdsURLRewriteAction(httpRoute.Destination.Name, httpRoute.URLRewrite, httpRoute.PathMatch)
+		if httpRoute.Mirrors != nil {
+			routeAction.RequestMirrorPolicies = buildXdsRequestMirrorPolicies(httpRoute.Mirrors)
+		}
+
+		if !httpRoute.IsHTTP2 {
+			// Allow websocket upgrades for HTTP 1.1
+			// Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Protocol_upgrade_mechanism
+			routeAction.UpgradeConfigs = []*routev3.RouteAction_UpgradeConfig{
+				{
+					UpgradeType: "websocket",
+				},
+			}
+		}
+
+		router.Action = &routev3.Route_Route{Route: routeAction}
+	default:
+		var routeAction *routev3.RouteAction
+		if httpRoute.BackendWeights.Invalid != 0 {
+			// If there are invalid backends then a weighted cluster is required for the route
+			routeAction = buildXdsWeightedRouteAction(httpRoute)
+		} else {
+			routeAction = buildXdsRouteAction(httpRoute)
+		}
+		if httpRoute.Mirrors != nil {
+			routeAction.RequestMirrorPolicies = buildXdsRequestMirrorPolicies(httpRoute.Mirrors)
+		}
+		if !httpRoute.IsHTTP2 {
+			// Allow websocket upgrades for HTTP 1.1
+			// Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Protocol_upgrade_mechanism
+			routeAction.UpgradeConfigs = []*routev3.RouteAction_UpgradeConfig{
+				{
+					UpgradeType: "websocket",
+				},
+			}
+		}
+		router.Action = &routev3.Route_Route{Route: routeAction}
+	}
+
+	// Hash Policy
+	if router.GetRoute() != nil {
+		router.GetRoute().HashPolicy = buildHashPolicy(httpRoute)
+	}
+
+	// Timeouts
+	if router.GetRoute() != nil && httpRoute.Timeout != nil && httpRoute.Timeout.HTTP != nil &&
+		httpRoute.Timeout.HTTP.RequestTimeout != nil {
+		router.GetRoute().Timeout = durationpb.New(httpRoute.Timeout.HTTP.RequestTimeout.Duration)
+	}
+
+	// Retries
+	if router.GetRoute() != nil && httpRoute.Retry != nil {
+		if rp, err := buildRetryPolicy(httpRoute); err == nil {
+			router.GetRoute().RetryPolicy = rp
+		} else {
+			return nil, err
+		}
+	}
+
+	// Add per route filter configs to the route, if needed.
+	if err := patchRouteWithPerRouteConfig(router, httpRoute); err != nil {
+		return nil, err
+	}
+
+	return router, nil
+}
+
+func buildXdsRouteMatch(pathMatch *ir.StringMatch, headerMatches []*ir.StringMatch, queryParamMatches []*ir.StringMatch) *routev3.RouteMatch {
+	outMatch := &routev3.RouteMatch{}
+
+	// Add a prefix match to '/' if no matches are specified
+	if pathMatch == nil {
+		// Setup default path specifier. It may be overwritten by :host:.
+		outMatch.PathSpecifier = &routev3.RouteMatch_Prefix{
+			Prefix: "/",
+		}
+	} else {
+		// Path match
+		//nolint:gocritic
+		if pathMatch.Exact != nil {
+			outMatch.PathSpecifier = &routev3.RouteMatch_Path{
+				Path: *pathMatch.Exact,
+			}
+		} else if pathMatch.Prefix != nil {
+			if *pathMatch.Prefix == "/" {
+				outMatch.PathSpecifier = &routev3.RouteMatch_Prefix{
+					Prefix: "/",
+				}
+			} else {
+				// Remove trailing /
+				trimmedPrefix := strings.TrimSuffix(*pathMatch.Prefix, "/")
+				outMatch.PathSpecifier = &routev3.RouteMatch_PathSeparatedPrefix{
+					PathSeparatedPrefix: trimmedPrefix,
+				}
+			}
+		} else if pathMatch.SafeRegex != nil {
+			outMatch.PathSpecifier = &routev3.RouteMatch_SafeRegex{
+				SafeRegex: &matcherv3.RegexMatcher{
+					Regex: *pathMatch.SafeRegex,
+				},
+			}
+		}
+	}
+	// Header matches
+	for _, headerMatch := range headerMatches {
+		stringMatcher := buildXdsStringMatcher(headerMatch)
+
+		headerMatcher := &routev3.HeaderMatcher{
+			Name: headerMatch.Name,
+			HeaderMatchSpecifier: &routev3.HeaderMatcher_StringMatch{
+				StringMatch: stringMatcher,
+			},
+		}
+		outMatch.Headers = append(outMatch.Headers, headerMatcher)
+	}
+
+	// Query param matches
+	for _, queryParamMatch := range queryParamMatches {
+		stringMatcher := buildXdsStringMatcher(queryParamMatch)
+
+		queryParamMatcher := &routev3.QueryParameterMatcher{
+			Name: queryParamMatch.Name,
+			QueryParameterMatchSpecifier: &routev3.QueryParameterMatcher_StringMatch{
+				StringMatch: stringMatcher,
+			},
+		}
+		outMatch.QueryParameters = append(outMatch.QueryParameters, queryParamMatcher)
+	}
+
+	return outMatch
+}
+
+func buildXdsStringMatcher(irMatch *ir.StringMatch) *matcherv3.StringMatcher {
+	stringMatcher := new(matcherv3.StringMatcher)
+
+	//nolint:gocritic
+	if irMatch.Exact != nil {
+		stringMatcher = &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_Exact{
+				Exact: *irMatch.Exact,
+			},
+		}
+	} else if irMatch.Prefix != nil {
+		stringMatcher = &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_Prefix{
+				Prefix: *irMatch.Prefix,
+			},
+		}
+	} else if irMatch.Suffix != nil {
+		stringMatcher = &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_Suffix{
+				Suffix: *irMatch.Suffix,
+			},
+		}
+	} else if irMatch.SafeRegex != nil {
+		stringMatcher = &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_SafeRegex{
+				SafeRegex: &matcherv3.RegexMatcher{
+					Regex: *irMatch.SafeRegex,
+				},
+			},
+		}
+	}
+
+	return stringMatcher
+}
+
+func buildXdsRouteAction(httpRoute *ir.HTTPRoute) *routev3.RouteAction {
+	return &routev3.RouteAction{
+		ClusterSpecifier: &routev3.RouteAction_Cluster{
+			Cluster: httpRoute.Destination.Name,
+		},
+		IdleTimeout: idleTimeout(httpRoute),
+	}
+}
+
+func buildXdsWeightedRouteAction(httpRoute *ir.HTTPRoute) *routev3.RouteAction {
+	clusters := []*routev3.WeightedCluster_ClusterWeight{
+		{
+			Name:   "invalid-backend-cluster",
+			Weight: &wrapperspb.UInt32Value{Value: httpRoute.BackendWeights.Invalid},
+		},
+	}
+
+	if httpRoute.BackendWeights.Valid > 0 {
+		validCluster := &routev3.WeightedCluster_ClusterWeight{
+			Name:   httpRoute.Destination.Name,
+			Weight: &wrapperspb.UInt32Value{Value: httpRoute.BackendWeights.Valid},
+		}
+		clusters = append(clusters, validCluster)
+	}
+
+	return &routev3.RouteAction{
+		// Intentionally route to a non-existent cluster and return a 500 error when it is not found
+		ClusterNotFoundResponseCode: routev3.RouteAction_INTERNAL_SERVER_ERROR,
+		ClusterSpecifier: &routev3.RouteAction_WeightedClusters{
+			WeightedClusters: &routev3.WeightedCluster{
+				Clusters: clusters,
+			},
+		},
+		IdleTimeout: idleTimeout(httpRoute),
+	}
+}
+
+func idleTimeout(httpRoute *ir.HTTPRoute) *durationpb.Duration {
+	if httpRoute.Timeout != nil && httpRoute.Timeout.HTTP != nil {
+		if httpRoute.Timeout.HTTP.RequestTimeout != nil {
+			timeout := time.Hour // Default to 1 hour
+
+			// Ensure is not less than the request timeout
+			if timeout < httpRoute.Timeout.HTTP.RequestTimeout.Duration {
+				timeout = httpRoute.Timeout.HTTP.RequestTimeout.Duration
+			}
+
+			// Disable idle timeout when request timeout is disabled
+			if httpRoute.Timeout.HTTP.RequestTimeout.Duration == 0 {
+				timeout = 0
+			}
+
+			return durationpb.New(timeout)
+		}
+	}
+	return nil
+}
+
+func buildXdsRedirectAction(httpRoute *ir.HTTPRoute) *routev3.RedirectAction {
+	var (
+		redirection = httpRoute.Redirect
+		routeAction = &routev3.RedirectAction{}
+	)
+
+	if redirection.Scheme != nil {
+		routeAction.SchemeRewriteSpecifier = &routev3.RedirectAction_SchemeRedirect{
+			SchemeRedirect: *redirection.Scheme,
+		}
+	}
+	if redirection.Path != nil {
+		if redirection.Path.FullReplace != nil {
+			routeAction.PathRewriteSpecifier = &routev3.RedirectAction_PathRedirect{
+				PathRedirect: *redirection.Path.FullReplace,
+			}
+		} else if redirection.Path.PrefixMatchReplace != nil {
+			if useRegexRewriteForPrefixMatchReplace(httpRoute.PathMatch, *redirection.Path.PrefixMatchReplace) {
+				routeAction.PathRewriteSpecifier = &routev3.RedirectAction_RegexRewrite{
+					RegexRewrite: prefix2RegexRewrite(*httpRoute.PathMatch.Prefix),
+				}
+			} else {
+				routeAction.PathRewriteSpecifier = &routev3.RedirectAction_PrefixRewrite{
+					PrefixRewrite: *redirection.Path.PrefixMatchReplace,
+				}
+			}
+		}
+	}
+	if redirection.Hostname != nil {
+		routeAction.HostRedirect = *redirection.Hostname
+	}
+	if redirection.Port != nil {
+		routeAction.PortRedirect = *redirection.Port
+	}
+	if redirection.StatusCode != nil {
+		if *redirection.StatusCode == 302 {
+			routeAction.ResponseCode = routev3.RedirectAction_FOUND
+		} // no need to check for 301 since Envoy will use 301 as the default if the field is not configured
+	}
+
+	return routeAction
+}
+
+// useRegexRewriteForPrefixMatchReplace checks if the regex rewrite should be used for prefix match replace
+// due to the issue with Envoy not handling the case of "//" when the replace string is "/".
+// See: https://github.com/envoyproxy/envoy/issues/26055
+func useRegexRewriteForPrefixMatchReplace(pathMatch *ir.StringMatch, prefixMatchReplace string) bool {
+	return pathMatch != nil &&
+		pathMatch.Prefix != nil &&
+		(prefixMatchReplace == "" || prefixMatchReplace == "/")
+}
+
+func prefix2RegexRewrite(prefix string) *matcherv3.RegexMatchAndSubstitute {
+	return &matcherv3.RegexMatchAndSubstitute{
+		Pattern: &matcherv3.RegexMatcher{
+			Regex: "^" + prefix + `\/*`,
+		},
+		Substitution: "/",
+	}
+}
+
+func buildXdsURLRewriteAction(destName string, urlRewrite *ir.URLRewrite, pathMatch *ir.StringMatch) *routev3.RouteAction {
+	routeAction := &routev3.RouteAction{
+		ClusterSpecifier: &routev3.RouteAction_Cluster{
+			Cluster: destName,
+		},
+	}
+
+	if urlRewrite.Path != nil {
+		if urlRewrite.Path.FullReplace != nil {
+			routeAction.RegexRewrite = &matcherv3.RegexMatchAndSubstitute{
+				Pattern: &matcherv3.RegexMatcher{
+					Regex: "/.+",
+				},
+				Substitution: *urlRewrite.Path.FullReplace,
+			}
+		} else if urlRewrite.Path.PrefixMatchReplace != nil {
+			// Circumvent the case of "//" when the replace string is "/"
+			// An empty replace string does not seem to solve the issue so we are using
+			// a regex match and replace instead
+			// Remove this workaround once https://github.com/envoyproxy/envoy/issues/26055 is fixed
+			if useRegexRewriteForPrefixMatchReplace(pathMatch, *urlRewrite.Path.PrefixMatchReplace) {
+				routeAction.RegexRewrite = prefix2RegexRewrite(*pathMatch.Prefix)
+			} else {
+				routeAction.PrefixRewrite = *urlRewrite.Path.PrefixMatchReplace
+			}
+		}
+	}
+
+	if urlRewrite.Hostname != nil {
+		routeAction.HostRewriteSpecifier = &routev3.RouteAction_HostRewriteLiteral{
+			HostRewriteLiteral: *urlRewrite.Hostname,
+		}
+
+		routeAction.AppendXForwardedHost = true
+	}
+
+	return routeAction
+}
+
+func buildXdsDirectResponseAction(res *ir.DirectResponse) *routev3.DirectResponseAction {
+	routeAction := &routev3.DirectResponseAction{Status: res.StatusCode}
+
+	if res.Body != nil {
+		routeAction.Body = &corev3.DataSource{
+			Specifier: &corev3.DataSource_InlineString{
+				InlineString: *res.Body,
+			},
+		}
+	}
+
+	return routeAction
+}
+
+func buildXdsRequestMirrorPolicies(mirrorDestinations []*ir.RouteDestination) []*routev3.RouteAction_RequestMirrorPolicy {
+	var mirrorPolicies []*routev3.RouteAction_RequestMirrorPolicy
+
+	for _, mirrorDest := range mirrorDestinations {
+		mirrorPolicies = append(mirrorPolicies, &routev3.RouteAction_RequestMirrorPolicy{
+			Cluster: mirrorDest.Name,
+		})
+	}
+
+	return mirrorPolicies
+}
+
+func buildXdsAddedHeaders(headersToAdd []ir.AddHeader) []*corev3.HeaderValueOption {
+	headerValueOptions := make([]*corev3.HeaderValueOption, len(headersToAdd))
+
+	for i, header := range headersToAdd {
+		var appendAction corev3.HeaderValueOption_HeaderAppendAction
+
+		if header.Append {
+			appendAction = corev3.HeaderValueOption_APPEND_IF_EXISTS_OR_ADD
+		} else {
+			appendAction = corev3.HeaderValueOption_OVERWRITE_IF_EXISTS_OR_ADD
+		}
+
+		headerValueOptions[i] = &corev3.HeaderValueOption{
+			Header: &corev3.HeaderValue{
+				Key:   header.Name,
+				Value: header.Value,
+			},
+			AppendAction: appendAction,
+		}
+
+		// Allow empty headers to be set, but don't add the config to do so unless necessary
+		if header.Value == "" {
+			headerValueOptions[i].KeepEmptyValue = true
+		}
+	}
+
+	return headerValueOptions
+}
+
+func buildHashPolicy(httpRoute *ir.HTTPRoute) []*routev3.RouteAction_HashPolicy {
+	// Return early
+	if httpRoute == nil || httpRoute.LoadBalancer == nil || httpRoute.LoadBalancer.ConsistentHash == nil {
+		return nil
+	}
+
+	if httpRoute.LoadBalancer.ConsistentHash.SourceIP != nil && *httpRoute.LoadBalancer.ConsistentHash.SourceIP {
+		hashPolicy := &routev3.RouteAction_HashPolicy{
+			PolicySpecifier: &routev3.RouteAction_HashPolicy_ConnectionProperties_{
+				ConnectionProperties: &routev3.RouteAction_HashPolicy_ConnectionProperties{
+					SourceIp: true,
+				},
+			},
+		}
+		return []*routev3.RouteAction_HashPolicy{hashPolicy}
+	}
+
+	return nil
+}
+
+func buildRetryPolicy(route *ir.HTTPRoute) (*routev3.RetryPolicy, error) {
+	if route.Retry != nil {
+		rr := route.Retry
+		rp := &routev3.RetryPolicy{
+			RetryOn:              retryDefaultRetryOn,
+			RetriableStatusCodes: []uint32{retryDefaultRetriableStatusCode},
+			NumRetries:           &wrapperspb.UInt32Value{Value: retryDefaultNumRetries},
+			RetryHostPredicate: []*routev3.RetryPolicy_RetryHostPredicate{
+				{
+					Name: "envoy.retry_host_predicates.previous_hosts",
+					ConfigType: &routev3.RetryPolicy_RetryHostPredicate_TypedConfig{
+						TypedConfig: protocov.ToAny(&previoushost.PreviousHostsPredicate{}),
+					},
+				},
+			},
+			HostSelectionRetryMaxAttempts: 5,
+		}
+
+		if rr.NumRetries != nil {
+			rp.NumRetries = &wrapperspb.UInt32Value{Value: *rr.NumRetries}
+		}
+
+		if rr.RetryOn != nil {
+			if rr.RetryOn.Triggers != nil && len(rr.RetryOn.Triggers) > 0 {
+				if ro, err := buildRetryOn(rr.RetryOn.Triggers); err == nil {
+					rp.RetryOn = ro
+				} else {
+					return nil, err
+				}
+			}
+
+			if rr.RetryOn.HTTPStatusCodes != nil && len(rr.RetryOn.HTTPStatusCodes) > 0 {
+				rp.RetriableStatusCodes = buildRetryStatusCodes(rr.RetryOn.HTTPStatusCodes)
+			}
+		}
+
+		if rr.PerRetry != nil {
+			if rr.PerRetry.Timeout != nil {
+				rp.PerTryTimeout = durationpb.New(rr.PerRetry.Timeout.Duration)
+			}
+
+			if rr.PerRetry.BackOff != nil {
+				bbo := false
+				rbo := &routev3.RetryPolicy_RetryBackOff{}
+				if rr.PerRetry.BackOff.BaseInterval != nil {
+					rbo.BaseInterval = durationpb.New(rr.PerRetry.BackOff.BaseInterval.Duration)
+					bbo = true
+				}
+
+				if rr.PerRetry.BackOff.MaxInterval != nil {
+					rbo.MaxInterval = durationpb.New(rr.PerRetry.BackOff.MaxInterval.Duration)
+					bbo = true
+				}
+
+				if bbo {
+					rp.RetryBackOff = rbo
+				}
+			}
+		}
+		return rp, nil
+	}
+
+	return nil, nil
+}
+
+func buildRetryStatusCodes(codes []ir.HTTPStatus) []uint32 {
+	ret := make([]uint32, len(codes))
+	for i, c := range codes {
+		ret[i] = uint32(c)
+	}
+	return ret
+}
+
+// buildRetryOn concatenates triggers to a comma-delimited string.
+// An error is returned if a trigger is not in the list of supported values (not likely, due to prior validations).
+func buildRetryOn(triggers []ir.TriggerEnum) (string, error) {
+	if len(triggers) == 0 {
+		return "", nil
+	}
+
+	lookup := map[ir.TriggerEnum]string{
+		ir.Error5XX:             "5xx",
+		ir.GatewayError:         "gateway-error",
+		ir.Reset:                "reset",
+		ir.ConnectFailure:       "connect-failure",
+		ir.Retriable4XX:         "retriable-4xx",
+		ir.RefusedStream:        "refused-stream",
+		ir.RetriableStatusCodes: "retriable-status-codes",
+		ir.Cancelled:            "cancelled",
+		ir.DeadlineExceeded:     "deadline-exceeded",
+		ir.Internal:             "internal",
+		ir.ResourceExhausted:    "resource-exhausted",
+		ir.Unavailable:          "unavailable",
+	}
+
+	var b strings.Builder
+
+	if t, found := lookup[triggers[0]]; found {
+		b.WriteString(t)
+	} else {
+		return "", errors.New("unsupported RetryOn trigger")
+	}
+
+	for _, v := range triggers[1:] {
+		if t, found := lookup[v]; found {
+			b.WriteString(",")
+			b.WriteString(t)
+		} else {
+			return "", errors.New("unsupported RetryOn trigger")
+		}
+	}
+
+	return b.String(), nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/runner/runner.go b/adapter/internal/operator/gateway-api/translator/runner/runner.go
new file mode 100644
index 000000000..be0131072
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/runner/runner.go
@@ -0,0 +1,139 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/translator"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+)
+
+type Config struct {
+	XdsIR *message.XdsIR
+	Xds   *message.Xds
+	// ExtensionManager  extension.Manager
+	ProviderResources *message.ProviderResources
+}
+
+type Runner struct {
+	Config
+}
+
+func New(cfg *Config) *Runner {
+	return &Runner{Config: *cfg}
+}
+
+func (r *Runner) Name() string {
+	return string("xds-translator")
+}
+
+// Start starts the xds-translator runner
+func (r *Runner) Start(ctx context.Context) (err error) {
+	go r.subscribeAndTranslate(ctx)
+	loggers.LoggerAPKOperator.Info("Started xds translator ...")
+	return
+}
+
+func (r *Runner) subscribeAndTranslate(ctx context.Context) {
+	// Subscribe to resources
+	message.HandleSubscription(message.Metadata{Runner: "xds-translator", Message: "xds-ir"}, r.XdsIR.Subscribe(ctx),
+		func(update message.Update[string, *ir.Xds], errChan chan error) {
+			loggers.LoggerAPKOperator.Info("Received an update in xds translator ...")
+			key := update.Key
+			val := update.Value
+
+			if update.Delete {
+				r.Xds.Delete(key)
+			} else {
+				// Translate to xds resources
+				t := &translator.Translator{}
+
+				// Set the extension manager if an extension is loaded
+				// if r.ExtensionManager != nil {
+				// 	t.ExtensionManager = &r.ExtensionManager
+				// }
+
+				// Set the rate limit service URL if global rate limiting is enabled.
+				// if r.EnvoyGateway.RateLimit != nil {
+				// 	t.GlobalRateLimit = &translator.GlobalRateLimitSettings{
+				// 		ServiceURL: ratelimit.GetServiceURL(r.Namespace, r.DNSDomain),
+				// 		FailClosed: r.EnvoyGateway.RateLimit.FailClosed,
+				// 	}
+				// 	if r.EnvoyGateway.RateLimit.Timeout != nil {
+				// 		t.GlobalRateLimit.Timeout = r.EnvoyGateway.RateLimit.Timeout.Duration
+				// 	}
+				// }
+
+				result, err := t.Translate(val)
+				if err != nil {
+					loggers.LoggerAPKOperator.Error("Failed to translate xds ir ", err)
+					errChan <- err
+				}
+
+				// xDS translation is done in a best-effort manner, so the result
+				// may contain partial resources even if there are errors.
+				if result == nil {
+					loggers.LoggerAPKOperator.Info("No xds resources to publish")
+					return
+				}
+
+				// Get all status keys from watchable and save them in the map statusesToDelete.
+				// Iterating through result.EnvoyPatchPolicyStatuses, any valid keys will be removed from statusesToDelete.
+				// Remaining keys will be deleted from watchable before we exit this function.
+				// statusesToDelete := make(map[ktypes.NamespacedName]bool)
+				// for key := range r.ProviderResources.EnvoyPatchPolicyStatuses.LoadAll() {
+				// 	statusesToDelete[key] = true
+				// }
+
+				// // Publish EnvoyPatchPolicyStatus
+				// for _, e := range result.EnvoyPatchPolicyStatuses {
+				// 	key := ktypes.NamespacedName{
+				// 		Name:      e.Name,
+				// 		Namespace: e.Namespace,
+				// 	}
+				// 	// Skip updating status for policies with empty status
+				// 	// They may have been skipped in this translation because
+				// 	// their target is not found (not relevant)
+				// 	if !(reflect.ValueOf(e.Status).IsZero()) {
+				// 		r.ProviderResources.EnvoyPatchPolicyStatuses.Store(key, e.Status)
+				// 	}
+				// 	delete(statusesToDelete, key)
+				// }
+				// // Discard the EnvoyPatchPolicyStatuses to reduce memory footprint
+				// result.EnvoyPatchPolicyStatuses = nil
+
+				// Publish
+				r.Xds.Store(key, result)
+
+				// Delete all the deletable status keys
+				// for key := range statusesToDelete {
+				// 	r.ProviderResources.EnvoyPatchPolicyStatuses.Delete(key)
+				// }
+			}
+		},
+	)
+	loggers.LoggerAPKOperator.Info("subscriber shutting down")
+}
diff --git a/adapter/internal/operator/gateway-api/translator/runner/runner_test.go b/adapter/internal/operator/gateway-api/translator/runner/runner_test.go
new file mode 100644
index 000000000..205f36236
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/runner/runner_test.go
@@ -0,0 +1,199 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRunner(t *testing.T) {
+	// Setup
+	xdsIR := new(message.XdsIR)
+	xds := new(message.Xds)
+	pResource := new(message.ProviderResources)
+	// cfg, err := config.New()
+	// require.NoError(t, err)
+	r := New(&Config{
+		// Server:            *cfg,
+		ProviderResources: pResource,
+		XdsIR:             xdsIR,
+		Xds:               xds,
+	})
+
+	ctx := context.Background()
+	// Start
+	err := r.Start(ctx)
+	require.NoError(t, err)
+
+	// xDS is nil at start
+	require.Equal(t, map[string]*ir.Xds{}, xdsIR.LoadAll())
+
+	// test translation
+	path := "example"
+	res := ir.Xds{
+		HTTP: []*ir.HTTPListener{
+			{
+				Name:      "test",
+				Address:   "0.0.0.0",
+				Port:      80,
+				Hostnames: []string{"example.com"},
+				Routes: []*ir.HTTPRoute{
+					{
+						Name: "test-route",
+						PathMatch: &ir.StringMatch{
+							Exact: &path,
+						},
+						Destination: &ir.RouteDestination{
+							Name: "test-dest",
+							Settings: []*ir.DestinationSetting{
+								{
+									Endpoints: []*ir.DestinationEndpoint{
+										{
+											Host: "10.11.12.13",
+											Port: 8080,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	xdsIR.Store("test", &res)
+	require.Eventually(t, func() bool {
+		out := xds.LoadAll()
+		if out == nil {
+			return false
+		}
+		if out["test"] == nil {
+			return false
+		}
+		// Ensure an xds listener is created
+		return len(out["test"].XdsResources[resourcev3.ListenerType]) == 1
+	}, time.Second*5, time.Millisecond*50)
+
+	// Delete the IR triggering an xds delete
+	xdsIR.Delete("test")
+	require.Eventually(t, func() bool {
+		out := xds.LoadAll()
+		// Ensure that xds has no key, value pairs
+		return len(out) == 0
+	}, time.Second*5, time.Millisecond*50)
+
+}
+
+func TestRunner_withExtensionManager(t *testing.T) {
+	// Setup
+	xdsIR := new(message.XdsIR)
+	xds := new(message.Xds)
+	pResource := new(message.ProviderResources)
+
+	// cfg, err := config.New()
+	// require.NoError(t, err)
+	r := New(&Config{
+		// Server:            *cfg,
+		ProviderResources: pResource,
+		XdsIR:             xdsIR,
+		Xds:               xds,
+		// ExtensionManager:  &extManagerMock{},
+	})
+
+	ctx := context.Background()
+	// Start
+	err := r.Start(ctx)
+	require.NoError(t, err)
+
+	// xDS is nil at start
+	require.Equal(t, map[string]*ir.Xds{}, xdsIR.LoadAll())
+
+	// test translation
+	path := "example"
+	res := ir.Xds{
+		HTTP: []*ir.HTTPListener{
+			{
+				Name:      "test",
+				Address:   "0.0.0.0",
+				Port:      80,
+				Hostnames: []string{"example.com"},
+				Routes: []*ir.HTTPRoute{
+					{
+						Name: "test-route",
+						PathMatch: &ir.StringMatch{
+							Exact: &path,
+						},
+						Destination: &ir.RouteDestination{
+							Name: "test-dest",
+							Settings: []*ir.DestinationSetting{
+								{
+									Endpoints: []*ir.DestinationEndpoint{
+										{
+											Host: "10.11.12.13",
+											Port: 8080,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	xdsIR.Store("test", &res)
+	require.Eventually(t, func() bool {
+		out := xds.LoadAll()
+		// xDS translation is done in a best-effort manner, so event the extension
+		// manager returns an error, the xDS resources should still be created.
+		return len(out) == 1
+	}, time.Second*5, time.Millisecond*50)
+}
+
+// type extManagerMock struct {
+// 	types.Manager
+// }
+
+// func (m *extManagerMock) GetPostXDSHookClient(xdsHookType v1alpha1.XDSTranslatorHook) types.XDSHookClient {
+// 	if xdsHookType == v1alpha1.XDSHTTPListener {
+// 		return &xdsHookClientMock{}
+// 	}
+
+// 	return nil
+// }
+
+// type xdsHookClientMock struct {
+// 	types.XDSHookClient
+// }
+
+// func (c *xdsHookClientMock) PostHTTPListenerModifyHook(*listenerv3.Listener) (*listenerv3.Listener, error) {
+// 	return nil, fmt.Errorf("assuming a network error during the call")
+// }
diff --git a/adapter/internal/operator/gateway-api/translator/tcpkeepalive.go b/adapter/internal/operator/gateway-api/translator/tcpkeepalive.go
new file mode 100644
index 000000000..a3d5b06f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/tcpkeepalive.go
@@ -0,0 +1,82 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+)
+
+// buildTCPSocketOptions converts listener downstream settings to xds socketOptions
+func buildTCPSocketOptions(keepAlive *ir.TCPKeepalive) []*corev3.SocketOption {
+	if keepAlive == nil {
+		return nil
+	}
+
+	socketOptions := make([]*corev3.SocketOption, 0)
+	// Enable Keep Alives
+	socketOption := &corev3.SocketOption{
+		Description: "socket option to enable tcp keep alive",
+		Level:       0x1,                                        // syscall.SOL_SOCKET has a different value for Darwin, resulting in `go test` failing
+		Name:        0x9,                                        // syscall.SO_KEEPALIVE has a different value for Darwin, resulting in `go test` failing
+		Value:       &corev3.SocketOption_IntValue{IntValue: 1}, // Enable
+	}
+
+	socketOptions = append(socketOptions, socketOption)
+
+	if keepAlive.Probes != nil {
+		socketOption = &corev3.SocketOption{
+			Description: "socket option for keep alive probes",
+			Level:       0x6, // Darwin lacks syscall.SOL_TCP
+			Name:        0x6, // Darwin lacks syscall.TCP_KEEPCNT,
+			Value:       &corev3.SocketOption_IntValue{IntValue: int64(*keepAlive.Probes)},
+			State:       corev3.SocketOption_STATE_PREBIND,
+		}
+		socketOptions = append(socketOptions, socketOption)
+	}
+
+	if keepAlive.IdleTime != nil {
+		socketOption = &corev3.SocketOption{
+			Description: "socket option for keep alive idle time",
+			Level:       0x6, // Darwin lacks syscall.SOL_TCP
+			Name:        0x4, // Darwin lacks syscall.TCP_KEEPIDLE,
+			Value:       &corev3.SocketOption_IntValue{IntValue: int64(*keepAlive.IdleTime)},
+			State:       corev3.SocketOption_STATE_PREBIND,
+		}
+		socketOptions = append(socketOptions, socketOption)
+	}
+
+	if keepAlive.Interval != nil {
+		socketOption = &corev3.SocketOption{
+			Description: "socket option for keep alive interval",
+			Level:       0x6, // Darwin lacks syscall.SOL_TCP
+			Name:        0x5, // Darwin lacks syscall.TCP_KEEPINTVL,
+			Value:       &corev3.SocketOption_IntValue{IntValue: int64(*keepAlive.Interval)},
+			State:       corev3.SocketOption_STATE_PREBIND,
+		}
+		socketOptions = append(socketOptions, socketOption)
+	}
+
+	return socketOptions
+
+}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog-invalid.yaml
new file mode 100644
index 000000000..37ce0958e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog-invalid.yaml
@@ -0,0 +1,43 @@
+name: "accesslog"
+accesslog:
+  text:
+  - path: "/dev/stdout"
+    format: |
+      [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+  json:
+  - path: "/dev/stdout"
+    json:
+      start_time: "%START_TIME%"
+      method: "%REQ(:METHOD)%"
+      path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
+      protocol: "%PROTOCOL%"
+      response_code: "%RESPONSE_CODE%"
+  openTelemetry:
+  - text: |
+      [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+    attributes:
+      "response_code": "%RESPONSE_CODE%"
+    resources:
+      "cluster_name": "cluster1"
+    host: ""
+    port: 4317
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "direct-route"
+    destination:
+      name: "direct-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    directResponse:
+      body: "Unknown custom filter type: UnsupportedType"
+      statusCode: 500
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog.yaml
new file mode 100644
index 000000000..f4ec43ac0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog.yaml
@@ -0,0 +1,44 @@
+name: "accesslog"
+accesslog:
+  text:
+  - path: "/dev/stdout"
+    format: |
+      [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+  json:
+  - path: "/dev/stdout"
+    json:
+      start_time: "%START_TIME%"
+      method: "%REQ(:METHOD)%"
+      path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
+      protocol: "%PROTOCOL%"
+      response_code: "%RESPONSE_CODE%"
+  openTelemetry:
+  - text: |
+      [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+    attributes:
+      "response_code": "%RESPONSE_CODE%"
+    resources:
+      "cluster_name": "cluster1"
+    host: otel-collector.default.svc.cluster.local
+    port: 4317
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "direct-route"
+    hostname: "*"
+    destination:
+      name: "direct-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    directResponse:
+      body: "Unknown custom filter type: UnsupportedType"
+      statusCode: 500
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/basic-auth.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/basic-auth.yaml
new file mode 100644
index 000000000..af6baa0b7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/basic-auth.yaml
@@ -0,0 +1,22 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    basicAuth:
+      users: "dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo="
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/circuit-breaker.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/circuit-breaker.yaml
new file mode 100644
index 000000000..a63297e26
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/circuit-breaker.yaml
@@ -0,0 +1,24 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    circuitBreaker:
+      maxConnections: 1
+      maxPendingRequests: 1
+      maxParallelRequests: 1
+      maxParallelRetries: 2
+      maxRequestsPerConnection: 10
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/client-timeout.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/client-timeout.yaml
new file mode 100644
index 000000000..1c05b605a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/client-timeout.yaml
@@ -0,0 +1,22 @@
+http:
+  - name: "first-listener"
+    address: "0.0.0.0"
+    port: 10080
+    hostnames:
+      - "*"
+    path:
+      mergeSlashes: true
+      escapedSlashesAction: UnescapeAndRedirect
+    routes:
+      - name: "first-route"
+        hostname: "*"
+        destination:
+          name: "first-route-dest"
+          settings:
+            - endpoints:
+                - host: "1.2.3.4"
+                  port: 50000
+    timeout:
+      http:
+        requestReceivedTimeout: "5s"
+
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/cors.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/cors.yaml
new file mode 100644
index 000000000..c5a07bee8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/cors.yaml
@@ -0,0 +1,39 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    cors:
+      allowOrigins:
+      - name: example.com
+        stringMatch:
+        safeRegex: "*.example.com"
+      - name: foo.bar.com
+        stringMatch:
+        exact: foo.bar.com
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-1"
+      - "x-header-2"
+      exposeHeaders:
+      - "x-header-3"
+      - "x-header-4"
+      allowCredentials: true
+      maxAge: 1000s
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/empty.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/empty.yaml
new file mode 100644
index 000000000..e69de29bb
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/ext-auth.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/ext-auth.yaml
new file mode 100644
index 000000000..d1451e968
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/ext-auth.yaml
@@ -0,0 +1,61 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "www.example.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: httproute/default/httproute-1/rule/0/match/0/www_example_com
+    hostname: "*"
+    pathMatch:
+      exact: "foo"
+    destination:
+      name: httproute/default/httproute-1/rule/0
+      settings:
+      - endpoints:
+        - host: "10.0.0.1"
+          port: 50000
+    extAuth:
+      http:
+        authority: http-backend.envoy-gateway:80
+        headersToBackend:
+        - header1
+        - header2
+        path: /auth
+        destination:
+          name: securitypolicy/default/policy-for-first-route/http-backend
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 80
+            protocol: HTTP
+            weight: 1
+  - name: httproute/default/httproute-2/rule/0/match/0/www_example_com
+    hostname: "*"
+    pathMatch:
+      exact: "bar"
+    destination:
+      name: httproute/default/httproute-2/rule/0
+      settings:
+      - endpoints:
+        - host: "10.0.0.2"
+          port: 60000
+    extAuth:
+      grpc:
+        authority: grpc-backend.default:9000
+        destination:
+          name: securitypolicy/default/policy-for-second-route/grpc-backend
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 8.8.8.8
+              port: 9000
+            protocol: GRPC
+            weight: 1
+      headersToExtAuth:
+      - header1
+      - header2
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/fault-injection.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/fault-injection.yaml
new file mode 100644
index 000000000..a99b77d5e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/fault-injection.yaml
@@ -0,0 +1,83 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  hostnames:
+  - "*"
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    faultInjection:
+      abort:
+        httpStatus: 500
+        percentage: 0.01
+    pathMatch:
+      exact: "foo/bar"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route"
+    hostname: "*"
+    faultInjection:
+      delay:
+        fixedDelay: 5.4s
+        percentage: 80
+    pathMatch:
+      exact: "example"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route"
+    hostname: "*"
+    faultInjection:
+      abort:
+        httpStatus: 500
+        percentage: 100
+      delay:
+        fixedDelay: 5.005s
+        percentage: 100
+    pathMatch:
+      exact: "test"
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "fourth-route"
+    hostname: "*"
+    faultInjection:
+      abort:
+        grpcStatus: 14
+        percentage: 100
+      delay:
+        fixedDelay: 5.005s
+        percentage: 100
+    pathMatch:
+      exact: "test"
+    destination:
+      name: "fourth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "fifth-route"
+    hostname: "*"
+    faultInjection:
+    pathMatch:
+      exact: "test"
+    destination:
+      name: "fifth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/health-check.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/health-check.yaml
new file mode 100644
index 000000000..a767bdab2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/health-check.yaml
@@ -0,0 +1,124 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  port: 10080
+  hostnames:
+  - "*"
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    healthCheck:
+      active:
+        timeout: "500ms"
+        interval: "3s"
+        unhealthyThreshold: 3
+        healthyThreshold: 1
+        http:
+          host: "*"
+          path: "/healthz"
+          expectedResponse:
+            text: "ok"
+          expectedStatuses:
+          - 200
+          - 300
+      passive:
+        baseEjectionTime: 180s
+        interval: 2s
+        maxEjectionPercent: 100
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route"
+    hostname: "*"
+    healthCheck:
+      active:
+        timeout: "1s"
+        interval: "5s"
+        unhealthyThreshold: 3
+        healthyThreshold: 3
+        http:
+          host: "*"
+          path: "/healthz"
+          expectedResponse:
+            binary: "cG9uZw=="
+          expectedStatuses:
+          - 200
+          - 201
+      passive:
+        baseEjectionTime: 180s
+        interval: 1s
+        maxEjectionPercent: 100
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route"
+    hostname: "*"
+    healthCheck:
+      active:
+        timeout: "1s"
+        interval: "5s"
+        unhealthyThreshold: 3
+        healthyThreshold: 3
+        tcp:
+          send:
+            text: "ping"
+          receive:
+            text: "pong"
+      passive:
+        baseEjectionTime: 160s
+        interval: 1s
+        maxEjectionPercent: 100
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "fourth-route"
+    hostname: "*"
+    healthCheck:
+      active:
+        timeout: "1s"
+        interval: "5s"
+        unhealthyThreshold: 3
+        healthyThreshold: 3
+        tcp:
+          send:
+            binary: "cGluZw=="
+          receive:
+            binary: "cG9uZw=="
+      passive:
+        baseEjectionTime: 180s
+        interval: 1s
+        maxEjectionPercent: 90
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: true
+    destination:
+      name: "fourth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-direct-response.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-direct-response.yaml
new file mode 100644
index 000000000..9db15c7fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-direct-response.yaml
@@ -0,0 +1,22 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "direct-route"
+    hostname: "*"
+    destination:
+      name: "direct-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    directResponse:
+      body: "Unknown custom filter type: UnsupportedType"
+      statusCode: 500
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-dns-cluster.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-dns-cluster.yaml
new file mode 100644
index 000000000..1cb0be3ec
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-dns-cluster.yaml
@@ -0,0 +1,26 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      prefix: /
+    queryParamMatches:
+    - exact: "yes"
+      name: debug
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "foo.bar"
+          port: 50000
+        - host: "bar.foo"
+          port: 50001
+        addressType: FQDN
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-invalid.yaml
new file mode 100644
index 000000000..42184d404
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-invalid.yaml
@@ -0,0 +1,28 @@
+http:
+- name: "first-listener"
+  address: ""
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    - name: test
+      stringMatch:
+      suffix: "end"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-mirror.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-mirror.yaml
new file mode 100644
index 000000000..b00449b38
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-mirror.yaml
@@ -0,0 +1,24 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "mirror-route"
+    hostname: "*"
+    destination:
+      name: "route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    mirror:
+      name: "mirror-route-dest"
+      settings:
+      - endpoints:
+        - host: "2.3.4.5"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-matches.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-matches.yaml
new file mode 100644
index 000000000..81fc7da10
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-matches.yaml
@@ -0,0 +1,86 @@
+http:
+- name: first-listener
+  address: 0.0.0.0
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+    hostname: example.com
+    name: envoy-gateway/httproute-2/rule/0/match/0/example.com
+    pathMatch:
+      prefix: /v1/example
+    queryParamMatches:
+    - exact: "yes"
+      name: debug
+  - destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: 8.8.8.8
+          port: 8080
+    hostname: example.com
+    name: envoy-gateway/httproute-3/rule/0/match/0/example.com
+    pathMatch:
+      prefix: /v1/example
+  - destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+    headerMatches:
+    - exact: one
+      name: version
+    hostname: example.net
+    name: envoy-gateway/httproute-4/rule/0/match/0/example.net
+    pathMatch:
+      prefix: /v1/status
+  - destination:
+      name: "fourth-route-dest"
+      settings:
+      - endpoints:
+        - host: 8.8.8.8
+          port: 8080
+    hostname: example.net
+    name: envoy-gateway/httproute-5/rule/0/match/0/example.net
+    pathMatch:
+      prefix: /v1/status
+  - destination:
+      name: "fifth-route-dest"
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+    hostname: '*.com'
+    name: envoy-gateway/httproute-1/rule/0/match/0/*.com
+    pathMatch:
+      prefix: /foo
+  - destination:
+      name: "sixth-route-dest"
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+    hostname: '*.net'
+    name: envoy-gateway/httproute-1/rule/0/match/0/*.net
+    pathMatch:
+      prefix: /foo
+  - destination:
+      name: "seventh-route-dest"
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+    hostname: "*"
+    name: envoy-gateway/httproute-1/rule/0/match/0/*
+    pathMatch:
+      prefix: /
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-mirrors.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-mirrors.yaml
new file mode 100644
index 000000000..3d13de381
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-mirrors.yaml
@@ -0,0 +1,28 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "mirror-route"
+    hostname: "*"
+    destination:
+      name: "route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    mirrors:
+    - name: "mirror-route-dest"
+      settings:
+      - endpoints:
+        - host: "2.3.4.5"
+    - name: "mirror-route-dest1"
+      settings:
+      - endpoints:
+        - host: "3.4.5.6"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-partial-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-partial-invalid.yaml
new file mode 100644
index 000000000..d72ec1d2c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-partial-invalid.yaml
@@ -0,0 +1,46 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "valid-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    - name: test
+      stringMatch:
+      suffix: "end"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "valid-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "invalid-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    - name: test
+      stringMatch:
+      suffix: "end"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "invalid-route-dest"
+      settings:
+      - endpoints:
+        - host: ""
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-redirect.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-redirect.yaml
new file mode 100644
index 000000000..36599609d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-redirect.yaml
@@ -0,0 +1,52 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "redirect-route-1"
+    hostname: "*"
+    destination:
+      name: "redirect-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    redirect:
+      scheme: https
+      statusCode: 302
+      hostname: "redirected.com"
+      port: 8443
+      path:
+        prefixMatchReplace: /redirected
+  - name: "redirect-route-2"
+    hostname: "*"
+    pathMatch:
+      prefix: "/redirect"
+    destination:
+      name: "redirect-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    redirect:
+      path:
+        prefixMatchReplace: /
+  - name: "redirect-route-3"
+    hostname: "*"
+    pathMatch:
+      prefix: "/redirect/"
+    destination:
+      name: "redirect-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    redirect:
+      path:
+        prefixMatchReplace: /
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-regex.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-regex.yaml
new file mode 100644
index 000000000..d9558ad99
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-regex.yaml
@@ -0,0 +1,28 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "regex-route"
+    hostname: "*"
+    pathMatch:
+      safeRegex: "/v1/.*"
+    headerMatches:
+    - name: re_header
+      stringMatch:
+      safeRegex: ".*"
+    queryParamMatches:
+    - name: re_query
+      stringMatch:
+      safeRegex: ".*"
+    destination:
+      name: "regex-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-request-headers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-request-headers.yaml
new file mode 100644
index 000000000..c3dc4417d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-request-headers.yaml
@@ -0,0 +1,38 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "request-header-route"
+    hostname: "*"
+    destination:
+      name: "request-header-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    addRequestHeaders:
+    - name: "some-header"
+      value: "some-value"
+      append: true
+    - name: "some-header-2"
+      value: "some-value"
+      append: true
+    - name: "some-header3"
+      value: "some-value"
+      append: false
+    - name: "some-header4"
+      value: "some-value"
+      append: false
+    - name: "empty-header"
+      value: ""
+      append: false
+    removeRequestHeaders:
+    - "some-header5"
+    - "some-header6"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-headers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-headers.yaml
new file mode 100644
index 000000000..e3114e2d2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-headers.yaml
@@ -0,0 +1,35 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "response-header-route"
+    hostname: "*"
+    destination:
+      name: "response-header-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    addResponseHeaders:
+    - name: "some-header"
+      value: "some-value"
+      append: true
+    - name: "some-header-2"
+      value: "some-value"
+      append: true
+    - name: "some-header3"
+      value: "some-value"
+      append: false
+    - name: "some-header4"
+      value: "some-value"
+      append: false
+    - name: "empty-header"
+      value: ""
+      append: false
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-remove-headers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-remove-headers.yaml
new file mode 100644
index 000000000..0e59f8f12
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-remove-headers.yaml
@@ -0,0 +1,38 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "response-header-route"
+    hostname: "*"
+    destination:
+      name: "response-header-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    addResponseHeaders:
+    - name: "some-header"
+      value: "some-value"
+      append: true
+    - name: "some-header-2"
+      value: "some-value"
+      append: true
+    - name: "some-header3"
+      value: "some-value"
+      append: false
+    - name: "some-header4"
+      value: "some-value"
+      append: false
+    - name: "empty-header"
+      value: ""
+      append: false
+    removeResponseHeaders:
+    - "some-header5"
+    - "some-header6"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-remove-headers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-remove-headers.yaml
new file mode 100644
index 000000000..f7b30b3d7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-remove-headers.yaml
@@ -0,0 +1,22 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "response-header-route"
+    hostname: "*"
+    destination:
+      name: "response-header-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    removeResponseHeaders:
+    - "some-header5"
+    - "some-header6"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-root-path-url-prefix.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-root-path-url-prefix.yaml
new file mode 100644
index 000000000..f43076445
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-root-path-url-prefix.yaml
@@ -0,0 +1,27 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "rewrite-route"
+    pathMatch:
+      prefix: "/origin/"
+    hostname: gateway.envoyproxy.io
+    headerMatches:
+    - name: ":authority"
+      exact: gateway.envoyproxy.io
+    destination:
+      name: "rewrite-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    urlRewrite:
+      path:
+        prefixMatchReplace: /
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-fullpath.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-fullpath.yaml
new file mode 100644
index 000000000..4d08acb93
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-fullpath.yaml
@@ -0,0 +1,24 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "rewrite-route"
+    pathMatch:
+      prefix: "/origin"
+    hostname: gateway.envoyproxy.io
+    destination:
+      name: "rewrite-route"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    urlRewrite:
+      path:
+        fullReplace: /rewrite
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-host.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-host.yaml
new file mode 100644
index 000000000..8cc673a7e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-host.yaml
@@ -0,0 +1,28 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "rewrite-route"
+    pathMatch:
+      prefix: "/origin"
+    hostname: gateway.envoyproxy.io
+    headerMatches:
+    - name: ":authority"
+      exact: gateway.envoyproxy.io
+    destination:
+      name: "rewrite-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    urlRewrite:
+      hostname: "3.3.3.3"
+      path:
+        prefixMatchReplace: /rewrite
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-prefix.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-prefix.yaml
new file mode 100644
index 000000000..df4f2e9c2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-prefix.yaml
@@ -0,0 +1,27 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "rewrite-route"
+    pathMatch:
+      prefix: "/origin"
+    hostname: gateway.envoyproxy.io
+    headerMatches:
+    - name: ":authority"
+      exact: gateway.envoyproxy.io
+    destination:
+      name: "rewrite-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    urlRewrite:
+      path:
+        prefixMatchReplace: /rewrite
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-timeout.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-timeout.yaml
new file mode 100644
index 000000000..fdd2b84ef
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-timeout.yaml
@@ -0,0 +1,47 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    timeout:
+      http:
+        requestTimeout: 5s
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route"
+    hostname: "*"
+    timeout:
+      http:
+        requestTimeout: 4000s
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50001
+  - name: "third-route"
+    hostname: "*"
+    timeout:
+      http:
+        requestTimeout: 0s
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50002
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-backend.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-backend.yaml
new file mode 100644
index 000000000..2540dec62
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-backend.yaml
@@ -0,0 +1,31 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.1.1.1"
+          port: 50001
+        weight: 20
+      - endpoints:
+        - host: "2.2.2.2"
+          port: 50002
+        weight: 40
+      - endpoints:
+        - host: "3.3.3.3"
+          port: 50003
+        weight: 20
+      - endpoints:
+        - host: "4.4.4.4"
+          port: 50004
+        weight: 20
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-invalid-backend.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-invalid-backend.yaml
new file mode 100644
index 000000000..4419c5222
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-invalid-backend.yaml
@@ -0,0 +1,21 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    backendWeights:
+      invalid: 1
+      valid: 1
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml
new file mode 100644
index 000000000..3cc0e5e87
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml
@@ -0,0 +1,32 @@
+http:
+  - address: 0.0.0.0
+    hostnames:
+      - '*'
+    isHTTP2: false
+    name: envoy-gateway/gateway-btls/http
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.11
+                  port: 8080
+              protocol: HTTP
+              tls:
+                sni: example.com
+                useSystemTrustStore: true
+              weight: 1
+        hostname: '*'
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle-multiple-certs.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle-multiple-certs.yaml
new file mode 100644
index 000000000..7dd532ab4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle-multiple-certs.yaml
@@ -0,0 +1,86 @@
+http:
+  - address: 0.0.0.0
+    hostnames:
+      - '*'
+    isHTTP2: false
+    name: envoy-gateway/gateway-btls/http
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.12
+                  port: 8080
+              protocol: HTTPS
+              tls:
+                caCertificate:
+                  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                  name: policy-btls/policies-ca2
+                sni: bar.example.com
+              weight: 1
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.11
+                  port: 8080
+              protocol: HTTPS
+              tls:
+                caCertificate:
+                  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                  name: policy-btls/policies-ca
+                sni: example.com
+              weight: 1
+        hostname: '*'
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
+  - address: 0.0.0.0
+    hostnames:
+      - 'example.com'
+    isHTTP2: false
+    name: envoy-gateway/gateway-btls-2/http
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10081
+    routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        proxyProtocol:
+          version: "V2"
+        destination:
+          name: httproute/envoy-gateway/httproute-btls-2/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.12
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.11
+                  port: 8080
+              protocol: HTTPS
+              tls:
+                caCertificate:
+                  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                  name: policy-btls-2/policies-ca
+                sni: example.com
+              weight: 1
+        hostname: '*'
+        name: httproute/envoy-gateway/httproute-btls-2/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle.yaml
new file mode 100644
index 000000000..e28cd14d6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle.yaml
@@ -0,0 +1,34 @@
+http:
+  - address: 0.0.0.0
+    hostnames:
+      - '*'
+    isHTTP2: false
+    name: envoy-gateway/gateway-btls/http
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.11
+                  port: 8080
+              protocol: HTTP
+              tls:
+                CACertificate:
+                  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                  name: policy-btls/policies-ca
+                SNI: example.com
+              weight: 1
+        hostname: '*'
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route.yaml
new file mode 100644
index 000000000..0c89d5a18
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route.yaml
@@ -0,0 +1,28 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    - name: test
+      stringMatch:
+      suffix: "end"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-preserve-case.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-preserve-case.yaml
new file mode 100644
index 000000000..f857ac8f8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-preserve-case.yaml
@@ -0,0 +1,40 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  http1:
+    preserveHeaderCase: true
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "second-listener"
+  address: "0.0.0.0"
+  port: 10081
+  hostnames:
+  - "*"
+  http1:
+    preserveHeaderCase: true
+    enableTrailers: true
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "second-route"
+    hostname: "*"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.5"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-trailers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-trailers.yaml
new file mode 100644
index 000000000..511747449
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-trailers.yaml
@@ -0,0 +1,20 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  http1:
+    enableTrailers: true
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http10.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http10.yaml
new file mode 100644
index 000000000..47f57a044
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http10.yaml
@@ -0,0 +1,21 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  http1:
+    http10:
+      defaultHost: "foo.com"
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http2-route.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http2-route.yaml
new file mode 100644
index 000000000..f3dc12c5a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http2-route.yaml
@@ -0,0 +1,30 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  isHTTP2: true
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      name: "test"
+      exact: "foo/bar"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+        protocol: GRPC
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http3.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http3.yaml
new file mode 100644
index 000000000..299ea3241
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http3.yaml
@@ -0,0 +1,34 @@
+http:
+- address: 0.0.0.0
+  http3:
+    quicPort: 443
+  hostnames:
+  - '*'
+  isHTTP2: false
+  name: envoy-gateway/gateway-1/tls
+  port: 10443
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - backendWeights:
+      invalid: 0
+      valid: 0
+    destination:
+      name: httproute/default/httproute-1/rule/0
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+        weight: 1
+    hostname: '*'
+    name: httproute/default/httproute-1/rule/0/match/0/*
+    pathMatch:
+      distinct: false
+      name: ""
+      prefix: /
+  tls:
+    certificates:
+    - name: envoy-gateway-tls-secret-1
+      privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+      serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNxRENDQVpBQ0NRREVNZ1lZblFyQ29EQU5CZ2txaGtpRzl3MEJBUXNGQURBV01SUXdFZ1lEVlFRRERBdG0KYjI4dVltRnlMbU52YlRBZUZ3MHlNekF4TURVeE16UXpNalJhRncweU5EQXhNRFV4TXpRek1qUmFNQll4RkRBUwpCZ05WQkFNTUMyWnZieTVpWVhJdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDCkFRRUFuZEh6d21wS2NUSUViamhGZ2RXd1RSTjc1Y3A4b3VsWnhMMUdydlI2SXc3ejdqaTBSNFcvTm85bkdmOU0KWVAyQ1JqaXN6NTFtd3hTeGVCcm9jTGVBK21reGkxK2lEdk5kQytyU0x4MTN6RUxTQ25xYnVzUHM3bUdmSlpxOAo5TGhlbmx5bzQzaDVjYTZINUxqTXd1L1JHVWlGMzFYck5yaVlGQlB2RTJyQitkd24vTkVrUTRoOFJxcXlwcmtuCkYvcWM5Sk1ZQVlGRld1VkNwa0lFbmRYMUN5dlFOT2FkZmN2cmd6dDV2SmwwT2kxQWdyaU5hWGJFUEdudWY3STQKcXBCSEdVWE5lMVdsOVdlVklxS1g0T2FFWERWQzZGQzdHOHptZWVMVzFBa1lFVm5pcFg2b1NCK0JjL1NIVlZOaApzQkxSbXRuc3pmTnRUMlFyZCttcGt4ODBaUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1VKOElDCkJveUVqT3V3enBHYVJoR044QjRqT1B6aHVDT0V0ZDM3UzAybHUwN09IenlCdmJzVEd6S3dCZ0x5bVdmR2tINEIKajdDTHNwOEZ6TkhLWnVhQmdwblo5SjZETE9Od2ZXZTJBWXA3TGRmT0tWQlVkTVhRaU9tN2pKOUhob0Ntdk1ONwpic2pjaFdKb013ckZmK3dkQUthdHowcUFQeWhMeWUvRnFtaVZ4a09SWmF3K1Q5bURaK0g0OXVBU2d1SnVOTXlRClY2RXlYNmd0Z1dxMzc2SHZhWE1TLzNoYW1Zb1ZXWEk1TXhpUE9ZeG5BQmtKQjRTQ2dJUmVqYkpmVmFRdG9RNGEKejAyaVVMZW5ESUllUU9Zb2JLY01CWGYxQjRQQVFtc2VocVZJYnpzUUNHaTU0VkRyczZiWmQvN0pzMXpDcHBncwpKaUQ1SXFNaktXRHdxN2FLCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-add-op-without-value.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-add-op-without-value.yaml
new file mode 100644
index 000000000..ec101c8e8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-add-op-without-value.yaml
@@ -0,0 +1,45 @@
+envoyPatchPolicies:
+- status: {}
+  name: "first-policy"
+  namespace: "default"
+  jsonPatches:
+  - type: "type.googleapis.com/envoy.config.route.v3.RouteConfiguration"
+    name: "first-listener"
+    operation:
+      op: "add"
+      path: "/virtual_hosts/0/rate_limits"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-listener.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-listener.yaml
new file mode 100644
index 000000000..09806682e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-listener.yaml
@@ -0,0 +1,37 @@
+jsonPatches:
+- type: "type.googleapis.com/envoy.config.route.v3.RouteConfiguration"
+  name: "first-listener"
+  operation:
+    op: "add"
+    path: "/virtual_hosts/0/rate_limits"
+    value:
+    - actions:
+      - remote_address: {}
+- type: "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment"
+  name: "first-route"
+  operation:
+    op: "replace"
+    path: "/endpoints/0/load_balancing_weight"
+    value: "50"
+http:
+- name: "first-listener"
+  address: ""
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-patch.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-patch.yaml
new file mode 100644
index 000000000..6224d909f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-patch.yaml
@@ -0,0 +1,26 @@
+envoyPatchPolicies:
+- status: {}
+  name: "first-policy"
+  namespace: "default"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid.yaml
new file mode 100644
index 000000000..2d970ef21
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid.yaml
@@ -0,0 +1,41 @@
+envoyPatchPolicies:
+- status: {}
+  name: "first-policy"
+  namespace: "default"
+  jsonPatches:
+  - type: "type.googleapis.com/envoy.config.route.v3.RouteConfiguration"
+    name: "first-listener"
+    operation:
+      op: "add"
+      path: "/virtual_hosts/0/rate_limits"
+      value:
+      - actions:
+        - remote_address: {}
+  - type: "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment"
+    name: "first-route"
+    operation:
+      op: "replace"
+      path: "/endpoints/0/load_balancing_weight"
+      value: "50"
+http:
+- name: "first-listener"
+  address: ""
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: ""
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-missing-resource.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-missing-resource.yaml
new file mode 100644
index 000000000..6224d909f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-missing-resource.yaml
@@ -0,0 +1,26 @@
+envoyPatchPolicies:
+- status: {}
+  name: "first-policy"
+  namespace: "default"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-move-op-with-value.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-move-op-with-value.yaml
new file mode 100644
index 000000000..40ee65d1a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-move-op-with-value.yaml
@@ -0,0 +1,48 @@
+envoyPatchPolicies:
+- status: {}
+  name: "first-policy"
+  namespace: "default"
+  jsonPatches:
+  - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+    name: "first-listener"
+    operation:
+      op: "remove"
+      from: "/filter_chains/0/filters/0/typed_config/http_filters/0"
+      path: "/filter_chains/0/filters/0/typed_config/http_filters/1"
+      value:
+        test: "abc"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml
new file mode 100644
index 000000000..2a362a469
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml
@@ -0,0 +1,36 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: https://localhost/jwt/public-key/jwks.json
+        extractFrom:
+          cookies:
+          - session_access_token
+          headers:
+          - name: Authorization
+            valuePrefix: 'Bearer '
+          params:
+          - token
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml
new file mode 100644
index 000000000..558049ed5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml
@@ -0,0 +1,72 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route-www.test.com"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: http://localhost/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key1
+          claim: claim.neteased.key
+      - name: example2
+        issuer: https://www.two.example.com
+        audiences:
+        - one.foo.com
+        - two.foo.com
+        remoteJWKS:
+          uri: https://192.168.1.250:8080/jwt/public-key/jwks.json
+        recomputeRoute: true
+        claimToHeaders:
+        - header: one-route-example2-key1
+          claim: claim.neteased.key
+        - header: one-route-example2-key2
+          claim: name
+    destination:
+      name: "first-route-www.test.com-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route-www.test.com"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/baz"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: http://localhost/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: second-route-example-key1
+          claim: claim.neteased.key
+      - name: example2
+        issuer: https://www.two.example.com
+        audiences:
+        - one.foo.com
+        - two.foo.com
+        remoteJWKS:
+          uri: https://192.168.1.250:8080/jwt/public-key/jwks.json
+    destination:
+      name: "second-route-www.test.com-dest"
+      settings:
+      - endpoints:
+        - host: "5.6.7.8"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml
new file mode 100644
index 000000000..7dd2a4b73
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml
@@ -0,0 +1,52 @@
+accesslog:
+  text:
+  - path: "/dev/stdout"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: https://localhost/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: first-route-key
+          claim: claim.neteased.key
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/baz"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: https://localhost/jwt/public-key/jwks.json
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "5.6.7.8"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-ratelimit.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-ratelimit.yaml
new file mode 100644
index 000000000..9857cb58d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-ratelimit.yaml
@@ -0,0 +1,72 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    rateLimit:
+      global:
+        rules:
+        - headerMatches:
+          - name: "x-user-id"
+            exact: "one"
+          limit:
+            requests: 5
+            unit: second
+    pathMatch:
+      exact: "foo/bar"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: https://192.168.1.250/jwt/public-key/jwks.json
+  - name: "second-route"
+    hostname: "*"
+    rateLimit:
+      global:
+        rules:
+        - headerMatches:
+          - name: "x-user-id"
+            distinct: true
+          limit:
+            requests: 5
+            unit: second
+    pathMatch:
+      exact: "example"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route"
+    hostname: "*"
+    rateLimit:
+      global:
+        rules:
+        - limit:
+            requests: 5
+            unit: second
+    pathMatch:
+      exact: "test"
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml
new file mode 100644
index 000000000..4ff905bdc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml
@@ -0,0 +1,28 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: https://localhost/jwt/public-key/jwks.json
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-proxy-protocol.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-proxy-protocol.yaml
new file mode 100644
index 000000000..245099796
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-proxy-protocol.yaml
@@ -0,0 +1,32 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  enableProxyProtocol: true
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-tcp-keepalive.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-tcp-keepalive.yaml
new file mode 100644
index 000000000..1e4cdcdc5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-tcp-keepalive.yaml
@@ -0,0 +1,66 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.com"
+  tcpKeepalive: {}
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "second-listener"
+  address: "0.0.0.0"
+  port: 10081
+  hostnames:
+  - "foo.net"
+  tcpKeepalive:
+    probes: 7
+    interval: 200
+    idleTime: 50
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "second-route"
+    hostname: "*"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+tcp:
+- name: "third-listener"
+  address: "0.0.0.0"
+  port: 10082
+  tcpKeepalive: {}
+  tls:
+    passthrough:
+      snis:
+      - bar.com
+  destination:
+    name: "tls-route-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+- name: "fourth-listener"
+  address: "0.0.0.0"
+  tcpKeepalive:
+    probes: 10
+  port: 10083
+  destination:
+    name: "tcp-route-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/load-balancer.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/load-balancer.yaml
new file mode 100644
index 000000000..fbf13ae88
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/load-balancer.yaml
@@ -0,0 +1,75 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    loadBalancer:
+      roundRobin: {}
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route"
+    hostname: "*"
+    loadBalancer:
+      random: {}
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route"
+    hostname: "*"
+    loadBalancer:
+      leastRequest: {}
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "fourth-route"
+    hostname: "*"
+    loadBalancer:
+      consistentHash:
+        sourceIP: true
+    destination:
+      name: "fourth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "fifth-route"
+    hostname: "*"
+    loadBalancer:
+      leastRequest:
+        slowStart:
+          window: 60s
+    destination:
+      name: "fifth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "sixth-route"
+    hostname: "*"
+    loadBalancer:
+      roundRobin:
+        slowStart:
+          window: 300s
+    destination:
+      name: "sixth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/local-ratelimit.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/local-ratelimit.yaml
new file mode 100644
index 000000000..9e818b4d1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/local-ratelimit.yaml
@@ -0,0 +1,84 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route-ratelimit-single-rule"
+    hostname: "*"
+    rateLimit:
+      local:
+        default:
+          requests: 10
+          unit: Minute
+        rules:
+        - headerMatches:
+          - name: x-user-id
+            exact: one
+          - name: x-org-id
+            exact: foo
+          limit:
+            requests: 10
+            unit: Hour
+    pathMatch:
+      exact: "foo/bar"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route-ratelimit-multiple-rules"
+    hostname: "*"
+    rateLimit:
+      local:
+        default:
+          requests: 10
+          unit: Minute
+        rules:
+        - headerMatches:
+          - name: x-user-id
+            exact: one
+          - name: x-org-id
+            exact: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - cidrMatch:
+            cidr: 192.168.0.0/16
+            maskLen: 16
+          headerMatches:
+          - name: x-user-id
+            exact: two
+          - name: x-org-id
+            exact: bar
+          limit:
+            requests: 10
+            unit: Minute
+    pathMatch:
+      exact: "example"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route-ratelimit-no-rule"
+    hostname: "*"
+    rateLimit:
+      local:
+        default:
+          requests: 10
+          unit: Minute
+    pathMatch:
+      exact: "test"
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/metrics-virtual-host.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/metrics-virtual-host.yaml
new file mode 100644
index 000000000..39f1a23dc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/metrics-virtual-host.yaml
@@ -0,0 +1,21 @@
+name: "metrics"
+metrics:
+  enableVirtualHostStats: true
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mixed-tls-jwt-authn.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mixed-tls-jwt-authn.yaml
new file mode 100644
index 000000000..36984ea69
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mixed-tls-jwt-authn.yaml
@@ -0,0 +1,35 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+  - name: first-listener
+    # byte slice representation of "cert-data"
+    serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+    # byte slice representation of "key-data"
+    privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    requestAuthentication:
+      jwt:
+        providers:
+        - name: example
+          issuer: https://www.example.com
+          audiences:
+          - foo.com
+          remoteJWKS:
+            uri: https://localhost/jwt/public-key/jwks.json
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port-with-different-filters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port-with-different-filters.yaml
new file mode 100644
index 000000000..bec261bee
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port-with-different-filters.yaml
@@ -0,0 +1,119 @@
+# This is a test file for multiple Gateway HTTP listeners on the same port with different filters.
+# These HTTP listeners should be merged into a single HTTP connection manager,
+# and the filters should be merged into the DefaultFilterChain of the HTTP connection manager.
+http:
+  - name: default/gateway-1/http
+    address: 0.0.0.0
+    hostnames:
+      - 'www.foo.com'
+    isHTTP2: false
+    http3:
+      quicPort: 443
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        hostname: www.foo.com
+        isHTTP2: false
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo1
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 192.168.1.1
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+        basicAuth:
+          name: securitypolicy/default/policy-for-http-route-1
+          users: "dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo="
+      - name: httproute/default/httproute-2/rule/0/match/0/www_foo_com
+        hostname: www.foo.com
+        isHTTP2: false
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo2
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 192.168.1.2
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+        extAuth:
+          name: securitypolicy/default/policy-for-http-route-2
+          failOpen: true
+          http:
+            authority: http-backend.envoy-gateway:80
+            destination:
+              name: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+              settings:
+                - addressType: IP
+                  endpoints:
+                    - host: 7.7.7.7
+                      port: 80
+                  protocol: HTTP
+                  weight: 1
+            headersToBackend:
+              - header1
+              - header2
+            path: /auth
+  - name: default/gateway-2/http
+    address: 0.0.0.0
+    hostnames:
+      - 'www.bar.com'
+    isHTTP2: false
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - name: httproute/default/httproute-3/rule/0/match/0/www_bar_com
+        hostname: www.bar.com
+        isHTTP2: false
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-3/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 192.168.1.3
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+        oidc:
+          name: securitypolicy/default/policy-for-gateway-2
+          clientID: client.oauth.foo.com
+          clientSecret: Y2xpZW50MTpzZWNyZXQK
+          provider:
+            authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+            tokenEndpoint: https://oauth.foo.com/token
+          scopes:
+            - openid
+            - email
+            - profile
+          redirectURL: "https://www.example.com/foo/oauth2/callback"
+          redirectPath: "/foo/oauth2/callback"
+          logoutPath: "/foo/logout"
+          cookieSuffix: 5F93C2E4
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port.yaml
new file mode 100644
index 000000000..fccf73d51
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port.yaml
@@ -0,0 +1,116 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: first-listener
+      # byte slice representation of "cert-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "second-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.net"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: second-listener
+      # byte slice representation of "cert-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "second-route"
+    hostname: "*"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "third-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "example.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "third-route"
+    hostname: "*"
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "fourth-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "example.net"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "fourth-route"
+    hostname: "*"
+    destination:
+      name: "fourth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+tcp:
+- name: "fifth-listener"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    passthrough:
+      snis:
+      - bar.com
+  destination:
+    name: "tcp-route-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+- name: "sixth-listener"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    passthrough:
+      snis:
+      - bar.net
+  destination:
+    name: "tls-route-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-simple-tcp-route-same-port.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-simple-tcp-route-same-port.yaml
new file mode 100644
index 000000000..fca8012cd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-simple-tcp-route-same-port.yaml
@@ -0,0 +1,56 @@
+tcp:
+- name: "tcp-route-simple"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
+- name: "tcp-route-simple-1"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-1-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
+- name: "tcp-route-simple-2"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-2-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
+- name: "tcp-route-simple-3"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-3-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
+- name: "tcp-route-simple-4"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-4-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mutual-tls.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mutual-tls.yaml
new file mode 100644
index 000000000..ea7ebf48a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mutual-tls.yaml
@@ -0,0 +1,34 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    caCertificate:
+      name: ca-cert
+      certificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/oidc.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/oidc.yaml
new file mode 100644
index 000000000..b90a1c97f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/oidc.yaml
@@ -0,0 +1,58 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    oidc:
+      clientID: client.oauth.foo.com
+      clientSecret: Y2xpZW50MTpzZWNyZXQK
+      provider:
+        authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+        tokenEndpoint: https://oauth.foo.com/token
+      scopes:
+      - openid
+      - email
+      - profile
+      redirectURL: "https://www.example.com/foo/oauth2/callback"
+      redirectPath: "/foo/oauth2/callback"
+      logoutPath: "/foo/logout"
+      cookieSuffix: 5F93C2E4
+  - name: "second-route"
+    hostname: "*"
+    pathMatch:
+      exact: "bar"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    oidc:
+      clientID: client.oauth.bar.com
+      clientSecret: Y2xpZW50MTpzZWNyZXQK
+      provider:
+        authorizationEndpoint: https://oauth.bar.com/oauth2/v2/auth
+        tokenEndpoint: https://oauth.bar.com/token
+      scopes:
+      - openid
+      - email
+      - profile
+      redirectURL: "https://www.example.com/bar/oauth2/callback"
+      redirectPath: "/bar/oauth2/callback"
+      logoutPath: "/bar/logout"
+      cookieSuffix: 5f93c2e4
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/path-settings.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/path-settings.yaml
new file mode 100644
index 000000000..1eddbaab2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/path-settings.yaml
@@ -0,0 +1,18 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: false
+    escapedSlashesAction: UnescapeAndForward
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/proxy-protocol-upstream.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/proxy-protocol-upstream.yaml
new file mode 100644
index 000000000..adf21ca8f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/proxy-protocol-upstream.yaml
@@ -0,0 +1,20 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    proxyProtocol:
+      version: "V2"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/retry-partial-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/retry-partial-invalid.yaml
new file mode 100644
index 000000000..7f5938fd6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/retry-partial-invalid.yaml
@@ -0,0 +1,54 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    retry:
+      numRetries: 5
+      retryOn:
+        httpStatusCodes:
+        - 429
+        - 503
+        triggers:
+        - reset
+        - connect-failure
+        - retriable-status-codes
+      perRetry:
+        timeout: 250ms
+        backoff:
+          baseInterval: 100ms
+          maxInterval: 10s
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route-defaults"
+    hostname: "foo"
+    retry: {}
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route-error"
+    hostname: "bar"
+    retry:
+      retryOn:
+        triggers:
+        - this-is-not-a-trigger
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/simple-tls.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/simple-tls.yaml
new file mode 100644
index 000000000..730902033
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/simple-tls.yaml
@@ -0,0 +1,31 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/suppress-envoy-headers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/suppress-envoy-headers.yaml
new file mode 100644
index 000000000..f26d13b08
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/suppress-envoy-headers.yaml
@@ -0,0 +1,33 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  headers:
+    enableEnvoyHeaders: true
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-complex.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-complex.yaml
new file mode 100644
index 000000000..05ac88669
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-complex.yaml
@@ -0,0 +1,18 @@
+tcp:
+- name: "tcp-route-complex"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    passthrough:
+      snis:
+      - foo.com
+      - bar.com
+      - example.com
+  destination:
+    name: "tcp-route-complex-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid-endpoint.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid-endpoint.yaml
new file mode 100644
index 000000000..3885afa4f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid-endpoint.yaml
@@ -0,0 +1,11 @@
+tcp:
+- name: "tcp-route-simple"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-dest"
+    settings:
+    - endpoints:
+      - port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid.yaml
new file mode 100644
index 000000000..d14b325d3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid.yaml
@@ -0,0 +1,12 @@
+tcp:
+- name: "tcp-route-invalid"
+  address: ""
+  port: 10080
+  destination:
+    name: "tcp-route-invalid-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-simple.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-simple.yaml
new file mode 100644
index 000000000..f79cebf3e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-simple.yaml
@@ -0,0 +1,12 @@
+tcp:
+- name: "tcp-route-simple"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-tls-terminate.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-tls-terminate.yaml
new file mode 100644
index 000000000..0bd68608b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-tls-terminate.yaml
@@ -0,0 +1,18 @@
+tcp:
+- name: "tls-terminate"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    terminate:
+      certificates:
+      - Name: envoy-gateway-tls-secret-1
+        PrivateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+        ServerCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNxRENDQVpBQ0NRREVNZ1lZblFyQ29EQU5CZ2txaGtpRzl3MEJBUXNGQURBV01SUXdFZ1lEVlFRRERBdG0KYjI4dVltRnlMbU52YlRBZUZ3MHlNekF4TURVeE16UXpNalJhRncweU5EQXhNRFV4TXpRek1qUmFNQll4RkRBUwpCZ05WQkFNTUMyWnZieTVpWVhJdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDCkFRRUFuZEh6d21wS2NUSUViamhGZ2RXd1RSTjc1Y3A4b3VsWnhMMUdydlI2SXc3ejdqaTBSNFcvTm85bkdmOU0KWVAyQ1JqaXN6NTFtd3hTeGVCcm9jTGVBK21reGkxK2lEdk5kQytyU0x4MTN6RUxTQ25xYnVzUHM3bUdmSlpxOAo5TGhlbmx5bzQzaDVjYTZINUxqTXd1L1JHVWlGMzFYck5yaVlGQlB2RTJyQitkd24vTkVrUTRoOFJxcXlwcmtuCkYvcWM5Sk1ZQVlGRld1VkNwa0lFbmRYMUN5dlFOT2FkZmN2cmd6dDV2SmwwT2kxQWdyaU5hWGJFUEdudWY3STQKcXBCSEdVWE5lMVdsOVdlVklxS1g0T2FFWERWQzZGQzdHOHptZWVMVzFBa1lFVm5pcFg2b1NCK0JjL1NIVlZOaApzQkxSbXRuc3pmTnRUMlFyZCttcGt4ODBaUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1VKOElDCkJveUVqT3V3enBHYVJoR044QjRqT1B6aHVDT0V0ZDM3UzAybHUwN09IenlCdmJzVEd6S3dCZ0x5bVdmR2tINEIKajdDTHNwOEZ6TkhLWnVhQmdwblo5SjZETE9Od2ZXZTJBWXA3TGRmT0tWQlVkTVhRaU9tN2pKOUhob0Ntdk1ONwpic2pjaFdKb013ckZmK3dkQUthdHowcUFQeWhMeWUvRnFtaVZ4a09SWmF3K1Q5bURaK0g0OXVBU2d1SnVOTXlRClY2RXlYNmd0Z1dxMzc2SHZhWE1TLzNoYW1Zb1ZXWEk1TXhpUE9ZeG5BQmtKQjRTQ2dJUmVqYkpmVmFRdG9RNGEKejAyaVVMZW5ESUllUU9Zb2JLY01CWGYxQjRQQVFtc2VocVZJYnpzUUNHaTU0VkRyczZiWmQvN0pzMXpDcHBncwpKaUQ1SXFNaktXRHdxN2FLCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+  destination:
+    name: "tls-terminate-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-weighted-backend.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-weighted-backend.yaml
new file mode 100644
index 000000000..0bd5ac621
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-weighted-backend.yaml
@@ -0,0 +1,29 @@
+tcp:
+- name: "tcp-route-weighted-backend"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    passthrough:
+      snis:
+      - foo.com
+      - bar.com
+      - example.com
+  destination:
+    name: "tcp-route-weighted-backend-dest"
+    settings:
+    - endpoints:
+      - host: "1.1.1.1"
+        port: 50001
+      weight: 20
+    - endpoints:
+      - host: "2.2.2.2"
+        port: 50002
+      weight: 40
+    - endpoints:
+      - host: "3.3.3.3"
+        port: 50003
+      weight: 20
+    - endpoints:
+      - host: "4.4.4.4"
+        port: 50004
+      weight: 20
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/timeout.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/timeout.yaml
new file mode 100644
index 000000000..daee154f0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/timeout.yaml
@@ -0,0 +1,24 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    timeout:
+      tcp:
+        connectTimeout: "31s"
+      http:
+        connectionIdleTimeout: "32s"
+        maxConnectionDuration: "33s"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-route-passthrough.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-route-passthrough.yaml
new file mode 100644
index 000000000..a798d00b8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-route-passthrough.yaml
@@ -0,0 +1,30 @@
+tcp:
+- name: "tls-passthrough-foo"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    passthrough:
+      snis:
+      - foo.com
+  destination:
+    name: "tls-passthrough-foo-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
+- name: "tls-passthrough-bar"
+  address: "0.0.0.0"
+  port: 10081
+  tls:
+    passthrough:
+      snis:
+      - bar.com
+  destination:
+    name: "tls-passthrough-bar-dest"
+    settings:
+    - endpoints:
+      - host: "bar"
+        port: 50000
+      addressType: FQDN
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-with-ciphers-versions-alpn.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-with-ciphers-versions-alpn.yaml
new file mode 100644
index 000000000..c2dcb0302
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-with-ciphers-versions-alpn.yaml
@@ -0,0 +1,50 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  path:
+    escapedSlashesAction: UnescapeAndRedirect
+    mergeSlashes: true
+  port: 10080
+  hostnames:
+  - "foo.com"
+  tls:
+    ciphers:
+    - ECDHE-ECDSA-AES128-GCM-SHA256
+    - ECDHE-RSA-AES128-GCM-SHA256
+    - ECDHE-ECDSA-AES256-GCM-SHA384
+    - ECDHE-RSA-AES256-GCM-SHA384
+    ecdhCurves:
+    - X25519
+    - P-256
+    signatureAlgorithms:
+    - ecdsa_secp256r1_sha256
+    - rsa_pss_rsae_sha256
+    - rsa_pkcs1_sha256
+    - ecdsa_secp384r1_sha384
+    - rsa_pss_rsae_sha384
+    - rsa_pkcs1_sha384
+    - rsa_pss_rsae_sha512
+    - rsa_pkcs1_sha512
+    - rsa_pkcs1_sha1
+    maxVersion: "1.2"
+    minVersion: "1.0"
+    alpnProtocols:
+    - some-other-protocol
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing-invalid.yaml
new file mode 100644
index 000000000..d8b23c5d2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing-invalid.yaml
@@ -0,0 +1,43 @@
+name: "tracing"
+tracing:
+  serviceName: "fake-name.fake-ns"
+  samplingRate: 90
+  customTags:
+    "literal1":
+      type: Literal
+      literal:
+        value: "value1"
+    "env1":
+      type: Environment
+      environment:
+        name: "env1"
+        defaultValue: "-"
+    "req1":
+      type: RequestHeader
+      requestHeader:
+        name: "X-Request-Id"
+        defaultValue: "-"
+  provider:
+    host: ""
+    port: 4317
+http:
+  - name: "first-listener"
+    address: "0.0.0.0"
+    port: 10080
+    hostnames:
+      - "*"
+    path:
+      mergeSlashes: true
+      escapedSlashesAction: UnescapeAndRedirect
+    routes:
+      - name: "direct-route"
+        hostname: "*"
+        destination:
+          name: "direct-route-dest"
+          settings:
+            - endpoints:
+                - host: "1.2.3.4"
+                  port: 50000
+        directResponse:
+          body: "Unknown custom filter type: UnsupportedType"
+          statusCode: 500
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing.yaml
new file mode 100644
index 000000000..d67ab2d01
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing.yaml
@@ -0,0 +1,43 @@
+name: "tracing"
+tracing:
+  serviceName: "fake-name.fake-ns"
+  samplingRate: 90
+  customTags:
+    "literal1":
+      type: Literal
+      literal:
+        value: "value1"
+    "env1":
+      type: Environment
+      environment:
+        name: "env1"
+        defaultValue: "-"
+    "req1":
+      type: RequestHeader
+      requestHeader:
+        name: "X-Request-Id"
+        defaultValue: "-"
+  provider:
+    host: otel-collector.monitoring.svc.cluster.local
+    port: 4317
+http:
+  - name: "first-listener"
+    address: "0.0.0.0"
+    port: 10080
+    hostnames:
+      - "*"
+    path:
+      mergeSlashes: true
+      escapedSlashesAction: UnescapeAndRedirect
+    routes:
+      - name: "direct-route"
+        hostname: "*"
+        destination:
+          name: "direct-route-dest"
+          settings:
+            - endpoints:
+                - host: "1.2.3.4"
+                  port: 50000
+        directResponse:
+          body: "Unknown custom filter type: UnsupportedType"
+          statusCode: 500
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route-invalid.yaml
new file mode 100644
index 000000000..39ab4e7f4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route-invalid.yaml
@@ -0,0 +1,10 @@
+udp:
+- name: "udp-route"
+  port: 10080
+  destination:
+    name: "udp-reoute-dest"
+    settings:
+    - endpoints:
+      - host: ""
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route.yaml
new file mode 100644
index 000000000..fa4ffafc1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route.yaml
@@ -0,0 +1,12 @@
+udp:
+- name: "udp-route"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "udp-route-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/upstream-tcpkeepalive.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/upstream-tcpkeepalive.yaml
new file mode 100644
index 000000000..bb7febec8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/upstream-tcpkeepalive.yaml
@@ -0,0 +1,22 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    tcpKeepalive:
+      idleTime: 1200
+      interval: 60
+      probes: 3
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.clusters.yaml
new file mode 100644
index 000000000..716815648
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.clusters.yaml
@@ -0,0 +1,49 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: direct-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: direct-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: accesslog|otel-collector.default.svc.cluster.local|4317
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: otel-collector.default.svc.cluster.local
+              portValue: 4317
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: accesslog|otel-collector.default.svc.cluster.local|4317/backend/0
+  name: accesslog|otel-collector.default.svc.cluster.local|4317
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.endpoints.yaml
new file mode 100644
index 000000000..20c80b3aa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: direct-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: direct-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.listeners.yaml
new file mode 100644
index 000000000..21e2c2f66
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.listeners.yaml
@@ -0,0 +1,143 @@
+- accessLog:
+  - filter:
+      responseFlagFilter:
+        flags:
+        - NR
+    name: envoy.access_loggers.file
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      logFormat:
+        textFormatSource:
+          inlineString: |
+            [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+      path: /dev/stdout
+  - filter:
+      responseFlagFilter:
+        flags:
+        - NR
+    name: envoy.access_loggers.file
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      logFormat:
+        jsonFormat:
+          method: '%REQ(:METHOD)%'
+          path: '%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%'
+          protocol: '%PROTOCOL%'
+          response_code: '%RESPONSE_CODE%'
+          start_time: '%START_TIME%'
+      path: /dev/stdout
+  - filter:
+      responseFlagFilter:
+        flags:
+        - NR
+    name: envoy.access_loggers.open_telemetry
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig
+      attributes:
+        values:
+        - key: k8s.namespace.name
+          value:
+            stringValue: '%ENVIRONMENT(ENVOY_GATEWAY_NAMESPACE)%'
+        - key: k8s.pod.name
+          value:
+            stringValue: '%ENVIRONMENT(ENVOY_POD_NAME)%'
+        - key: response_code
+          value:
+            stringValue: '%RESPONSE_CODE%'
+      body:
+        stringValue: |
+          [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+      commonConfig:
+        grpcService:
+          envoyGrpc:
+            authority: otel-collector.default.svc.cluster.local
+            clusterName: accesslog|otel-collector.default.svc.cluster.local|4317
+        logName: otel_envoy_accesslog
+        transportApiVersion: V3
+      resourceAttributes:
+        values:
+        - key: cluster_name
+          value:
+            stringValue: cluster1
+  address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        accessLog:
+        - name: envoy.access_loggers.file
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+            logFormat:
+              textFormatSource:
+                inlineString: |
+                  [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+            path: /dev/stdout
+        - name: envoy.access_loggers.file
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+            logFormat:
+              jsonFormat:
+                method: '%REQ(:METHOD)%'
+                path: '%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%'
+                protocol: '%PROTOCOL%'
+                response_code: '%RESPONSE_CODE%'
+                start_time: '%START_TIME%'
+            path: /dev/stdout
+        - name: envoy.access_loggers.open_telemetry
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig
+            attributes:
+              values:
+              - key: k8s.namespace.name
+                value:
+                  stringValue: '%ENVIRONMENT(ENVOY_GATEWAY_NAMESPACE)%'
+              - key: k8s.pod.name
+                value:
+                  stringValue: '%ENVIRONMENT(ENVOY_POD_NAME)%'
+              - key: response_code
+                value:
+                  stringValue: '%RESPONSE_CODE%'
+            body:
+              stringValue: |
+                [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+            commonConfig:
+              grpcService:
+                envoyGrpc:
+                  authority: otel-collector.default.svc.cluster.local
+                  clusterName: accesslog|otel-collector.default.svc.cluster.local|4317
+              logName: otel_envoy_accesslog
+              transportApiVersion: V3
+            resourceAttributes:
+              values:
+              - key: cluster_name
+                value:
+                  stringValue: cluster1
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.routes.yaml
new file mode 100644
index 000000000..d4a7fa5ae
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - directResponse:
+        body:
+          inlineString: 'Unknown custom filter type: UnsupportedType'
+        status: 500
+      match:
+        prefix: /
+      name: direct-route
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.listeners.yaml
new file mode 100644
index 000000000..6fd92310d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.listeners.yaml
@@ -0,0 +1,39 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.basic_auth_first-route
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
+            users:
+              inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.routes.yaml
new file mode 100644
index 000000000..f87be1147
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo/bar
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.basic_auth_first-route:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.clusters.yaml
new file mode 100644
index 000000000..90636e8ff
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.clusters.yaml
@@ -0,0 +1,27 @@
+- circuitBreakers:
+    thresholds:
+    - maxConnections: 1
+      maxPendingRequests: 1
+      maxRequests: 1
+      maxRetries: 2
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      commonHttpProtocolOptions:
+        maxRequestsPerConnection: 10
+      explicitHttpConfig:
+        httpProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.listeners.yaml
new file mode 100644
index 000000000..af7af6027
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.listeners.yaml
@@ -0,0 +1,34 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        requestTimeout: 5s
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.listeners.yaml
new file mode 100644
index 000000000..624c74704
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.listeners.yaml
@@ -0,0 +1,36 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.cors
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.routes.yaml
new file mode 100644
index 000000000..f77625786
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.routes.yaml
@@ -0,0 +1,26 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo/bar
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.cors:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy
+          allowCredentials: true
+          allowHeaders: x-header-1, x-header-2
+          allowMethods: GET, POST
+          allowOriginStringMatch:
+          - safeRegex:
+              regex: '*.example.com'
+          - exact: foo.bar.com
+          exposeHeaders: x-header-3, x-header-4
+          maxAge: "1000"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.clusters.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.clusters.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.endpoints.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.endpoints.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.listeners.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.listeners.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.clusters.yaml
new file mode 100644
index 000000000..d02aa6b4a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.clusters.yaml
@@ -0,0 +1,73 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-1/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-1/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-2/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-2/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: securitypolicy/default/policy-for-first-route/http-backend
+  lbPolicy: LEAST_REQUEST
+  name: securitypolicy/default/policy-for-first-route/http-backend
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: securitypolicy/default/policy-for-second-route/grpc-backend
+  lbPolicy: LEAST_REQUEST
+  name: securitypolicy/default/policy-for-second-route/grpc-backend
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.endpoints.yaml
new file mode 100644
index 000000000..ce53193cd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.endpoints.yaml
@@ -0,0 +1,48 @@
+- clusterName: httproute/default/httproute-1/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.0.0.1
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-1/rule/0/backend/0
+- clusterName: httproute/default/httproute-2/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.0.0.2
+            portValue: 60000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-2/rule/0/backend/0
+- clusterName: securitypolicy/default/policy-for-first-route/http-backend
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 80
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: securitypolicy/default/policy-for-first-route/http-backend/backend/0
+- clusterName: securitypolicy/default/policy-for-second-route/grpc-backend
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 8.8.8.8
+            portValue: 9000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: securitypolicy/default/policy-for-second-route/grpc-backend/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
new file mode 100644
index 000000000..0913264d9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
@@ -0,0 +1,63 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_authz_httproute/default/httproute-1/rule/0/match/0/www_example_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            httpService:
+              authorizationResponse:
+                allowedUpstreamHeaders:
+                  patterns:
+                  - exact: header1
+                  - exact: header2
+              pathPrefix: /auth
+              serverUri:
+                cluster: securitypolicy/default/policy-for-first-route/http-backend
+                timeout: 10s
+                uri: http://http-backend.envoy-gateway:80/auth
+            transportApiVersion: V3
+        - disabled: true
+          name: envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_example_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            allowedHeaders:
+              patterns:
+              - exact: header1
+              - exact: header2
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend.default:9000
+                clusterName: securitypolicy/default/policy-for-second-route/grpc-backend
+              timeout: 10s
+            transportApiVersion: V3
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml
new file mode 100644
index 000000000..0b039af3d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml
@@ -0,0 +1,29 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo
+      name: httproute/default/httproute-1/rule/0/match/0/www_example_com
+      route:
+        cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz_httproute/default/httproute-1/rule/0/match/0/www_example_com:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+    - match:
+        path: bar
+      name: httproute/default/httproute-2/rule/0/match/0/www_example_com
+      route:
+        cluster: httproute/default/httproute-2/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_example_com:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.clusters.yaml
new file mode 100644
index 000000000..03e10ccd7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.clusters.yaml
@@ -0,0 +1,85 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fourth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: fourth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fifth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: fifth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.endpoints.yaml
new file mode 100644
index 000000000..b93d9b43b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.endpoints.yaml
@@ -0,0 +1,60 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
+- clusterName: fourth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fourth-route-dest/backend/0
+- clusterName: fifth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fifth-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.listeners.yaml
new file mode 100644
index 000000000..ff6bf7f2a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.listeners.yaml
@@ -0,0 +1,36 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.fault
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.routes.yaml
new file mode 100644
index 000000000..1f093f5a0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.routes.yaml
@@ -0,0 +1,84 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo/bar
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.fault:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
+          abort:
+            httpStatus: 500
+            percentage:
+              denominator: MILLION
+              numerator: 100
+    - match:
+        path: example
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.fault:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
+          delay:
+            fixedDelay: 5.400s
+            percentage:
+              denominator: MILLION
+              numerator: 800000
+    - match:
+        path: test
+      name: third-route
+      route:
+        cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.fault:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
+          abort:
+            httpStatus: 500
+            percentage:
+              denominator: MILLION
+              numerator: 1000000
+          delay:
+            fixedDelay: 5.005s
+            percentage:
+              denominator: MILLION
+              numerator: 1000000
+    - match:
+        path: test
+      name: fourth-route
+      route:
+        cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.fault:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
+          abort:
+            grpcStatus: 14
+            percentage:
+              denominator: MILLION
+              numerator: 1000000
+          delay:
+            fixedDelay: 5.005s
+            percentage:
+              denominator: MILLION
+              numerator: 1000000
+    - match:
+        path: test
+      name: fifth-route
+      route:
+        cluster: fifth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.clusters.yaml
new file mode 100644
index 000000000..b789b876c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.clusters.yaml
@@ -0,0 +1,141 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  healthChecks:
+  - healthyThreshold: 1
+    httpHealthCheck:
+      expectedStatuses:
+      - end: "201"
+        start: "200"
+      - end: "301"
+        start: "300"
+      host: '*'
+      path: /healthz
+      receive:
+      - text: 6f6b
+    interval: 3s
+    timeout: 0.500s
+    unhealthyThreshold: 3
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection:
+    baseEjectionTime: 180s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 0
+    consecutiveLocalOriginFailure: 5
+    interval: 2s
+    maxEjectionPercent: 100
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  healthChecks:
+  - healthyThreshold: 3
+    httpHealthCheck:
+      expectedStatuses:
+      - end: "202"
+        start: "200"
+      host: '*'
+      path: /healthz
+      receive:
+      - binary: cG9uZw==
+    interval: 5s
+    timeout: 1s
+    unhealthyThreshold: 3
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection:
+    baseEjectionTime: 180s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 0
+    consecutiveLocalOriginFailure: 5
+    interval: 1s
+    maxEjectionPercent: 100
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  healthChecks:
+  - healthyThreshold: 3
+    interval: 5s
+    tcpHealthCheck:
+      receive:
+      - text: 706f6e67
+      send:
+        text: "70696e67"
+    timeout: 1s
+    unhealthyThreshold: 3
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection:
+    baseEjectionTime: 160s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 0
+    consecutiveLocalOriginFailure: 5
+    interval: 1s
+    maxEjectionPercent: 100
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fourth-route-dest
+  healthChecks:
+  - healthyThreshold: 3
+    interval: 5s
+    tcpHealthCheck:
+      receive:
+      - binary: cG9uZw==
+      send:
+        binary: cGluZw==
+    timeout: 1s
+    unhealthyThreshold: 3
+  lbPolicy: LEAST_REQUEST
+  name: fourth-route-dest
+  outlierDetection:
+    baseEjectionTime: 180s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 0
+    consecutiveLocalOriginFailure: 5
+    interval: 1s
+    maxEjectionPercent: 90
+    splitExternalLocalOriginErrors: true
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.endpoints.yaml
new file mode 100644
index 000000000..f185af17d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.endpoints.yaml
@@ -0,0 +1,48 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
+- clusterName: fourth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fourth-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.routes.yaml
new file mode 100644
index 000000000..de4249178
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.routes.yaml
@@ -0,0 +1,35 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: third-route
+      route:
+        cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: fourth-route
+      route:
+        cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.clusters.yaml
new file mode 100644
index 000000000..f0ea3b323
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: direct-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: direct-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.endpoints.yaml
new file mode 100644
index 000000000..20c80b3aa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: direct-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: direct-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.routes.yaml
new file mode 100644
index 000000000..d4a7fa5ae
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - directResponse:
+        body:
+          inlineString: 'Unknown custom filter type: UnsupportedType'
+        status: 500
+      match:
+        prefix: /
+      name: direct-route
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.clusters.yaml
new file mode 100644
index 000000000..876e1084c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.clusters.yaml
@@ -0,0 +1,33 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: first-route-dest
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: foo.bar
+              portValue: 50000
+        loadBalancingWeight: 1
+      - endpoint:
+          address:
+            socketAddress:
+              address: bar.foo
+              portValue: 50001
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: first-route-dest/backend/0
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.endpoints.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.endpoints.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml
new file mode 100644
index 000000000..c27e2ea57
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.clusters.yaml
new file mode 100644
index 000000000..53d1f9a7c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: route-dest
+  lbPolicy: LEAST_REQUEST
+  name: route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.endpoints.yaml
new file mode 100644
index 000000000..43cba2e79
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml
new file mode 100644
index 000000000..c5a187d2c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: mirror-route
+      route:
+        cluster: route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.clusters.yaml
new file mode 100644
index 000000000..0322cbb61
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.clusters.yaml
@@ -0,0 +1,119 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fourth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: fourth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fifth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: fifth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: sixth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: sixth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: seventh-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: seventh-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.endpoints.yaml
new file mode 100644
index 000000000..3787880a3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.endpoints.yaml
@@ -0,0 +1,84 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 8.8.8.8
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
+- clusterName: fourth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 8.8.8.8
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fourth-route-dest/backend/0
+- clusterName: fifth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fifth-route-dest/backend/0
+- clusterName: sixth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: sixth-route-dest/backend/0
+- clusterName: seventh-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: seventh-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml
new file mode 100644
index 000000000..25584aa3a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml
@@ -0,0 +1,80 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - example.com
+    name: first-listener/example_com
+    routes:
+    - match:
+        pathSeparatedPrefix: /v1/example
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: envoy-gateway/httproute-2/rule/0/match/0/example.com
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        pathSeparatedPrefix: /v1/example
+      name: envoy-gateway/httproute-3/rule/0/match/0/example.com
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - example.net
+    name: first-listener/example_net
+    routes:
+    - match:
+        headers:
+        - name: version
+          stringMatch:
+            exact: one
+        pathSeparatedPrefix: /v1/status
+      name: envoy-gateway/httproute-4/rule/0/match/0/example.net
+      route:
+        cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        pathSeparatedPrefix: /v1/status
+      name: envoy-gateway/httproute-5/rule/0/match/0/example.net
+      route:
+        cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - '*.com'
+    name: first-listener/*_com
+    routes:
+    - match:
+        pathSeparatedPrefix: /foo
+      name: envoy-gateway/httproute-1/rule/0/match/0/*.com
+      route:
+        cluster: fifth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - '*.net'
+    name: first-listener/*_net
+    routes:
+    - match:
+        pathSeparatedPrefix: /foo
+      name: envoy-gateway/httproute-1/rule/0/match/0/*.net
+      route:
+        cluster: sixth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: envoy-gateway/httproute-1/rule/0/match/0/*
+      route:
+        cluster: seventh-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.clusters.yaml
new file mode 100644
index 000000000..046021604
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.clusters.yaml
@@ -0,0 +1,51 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: route-dest
+  lbPolicy: LEAST_REQUEST
+  name: route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: mirror-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: mirror-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: mirror-route-dest1
+  lbPolicy: LEAST_REQUEST
+  name: mirror-route-dest1
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.endpoints.yaml
new file mode 100644
index 000000000..f741af39c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.endpoints.yaml
@@ -0,0 +1,36 @@
+- clusterName: route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: route-dest/backend/0
+- clusterName: mirror-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 2.3.4.5
+            portValue: 0
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: mirror-route-dest/backend/0
+- clusterName: mirror-route-dest1
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 3.4.5.6
+            portValue: 0
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: mirror-route-dest1/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml
new file mode 100644
index 000000000..f46cc50eb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml
@@ -0,0 +1,17 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: mirror-route
+      route:
+        cluster: route-dest
+        requestMirrorPolicies:
+        - cluster: mirror-route-dest
+        - cluster: mirror-route-dest1
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.clusters.yaml
new file mode 100644
index 000000000..614968177
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: valid-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: valid-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.endpoints.yaml
new file mode 100644
index 000000000..4fdb0384f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: valid-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: valid-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml
new file mode 100644
index 000000000..61face5a3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml
@@ -0,0 +1,43 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        - name: test
+          stringMatch:
+            suffix: end
+        prefix: /
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: valid-route
+      route:
+        cluster: valid-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        - name: test
+          stringMatch:
+            suffix: end
+        prefix: /
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: invalid-route
+      route:
+        cluster: invalid-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.clusters.yaml
new file mode 100644
index 000000000..b435363be
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: redirect-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: redirect-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.endpoints.yaml
new file mode 100644
index 000000000..7543b702f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: redirect-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: redirect-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.routes.yaml
new file mode 100644
index 000000000..d2c46435e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.routes.yaml
@@ -0,0 +1,32 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: redirect-route-1
+      redirect:
+        hostRedirect: redirected.com
+        portRedirect: 8443
+        prefixRewrite: /redirected
+        responseCode: FOUND
+        schemeRedirect: https
+    - match:
+        pathSeparatedPrefix: /redirect
+      name: redirect-route-2
+      redirect:
+        regexRewrite:
+          pattern:
+            regex: ^/redirect\/*
+          substitution: /
+    - match:
+        pathSeparatedPrefix: /redirect
+      name: redirect-route-3
+      redirect:
+        regexRewrite:
+          pattern:
+            regex: ^/redirect/\/*
+          substitution: /
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.clusters.yaml
new file mode 100644
index 000000000..0f75e67e2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: regex-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: regex-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.endpoints.yaml
new file mode 100644
index 000000000..b36ee4500
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: regex-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: regex-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.routes.yaml
new file mode 100644
index 000000000..7bc7d162a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.routes.yaml
@@ -0,0 +1,25 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: re_header
+          stringMatch:
+            safeRegex:
+              regex: .*
+        queryParameters:
+        - name: re_query
+          stringMatch:
+            safeRegex:
+              regex: .*
+        safeRegex:
+          regex: /v1/.*
+      name: regex-route
+      route:
+        cluster: regex-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.clusters.yaml
new file mode 100644
index 000000000..2adb8e01e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: request-header-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: request-header-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.endpoints.yaml
new file mode 100644
index 000000000..846a89074
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: request-header-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: request-header-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml
new file mode 100644
index 000000000..f91a70cb2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml
@@ -0,0 +1,36 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: request-header-route
+      requestHeadersToAdd:
+      - header:
+          key: some-header
+          value: some-value
+      - header:
+          key: some-header-2
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header3
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header4
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: empty-header
+        keepEmptyValue: true
+      requestHeadersToRemove:
+      - some-header5
+      - some-header6
+      route:
+        cluster: request-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.clusters.yaml
new file mode 100644
index 000000000..ca020e482
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: response-header-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: response-header-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.endpoints.yaml
new file mode 100644
index 000000000..d21491f62
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: response-header-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: response-header-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml
new file mode 100644
index 000000000..b2241a118
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml
@@ -0,0 +1,33 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: response-header-route
+      responseHeadersToAdd:
+      - header:
+          key: some-header
+          value: some-value
+      - header:
+          key: some-header-2
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header3
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header4
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: empty-header
+        keepEmptyValue: true
+      route:
+        cluster: response-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.clusters.yaml
new file mode 100644
index 000000000..ca020e482
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: response-header-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: response-header-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.endpoints.yaml
new file mode 100644
index 000000000..d21491f62
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: response-header-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: response-header-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml
new file mode 100644
index 000000000..b09594aec
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml
@@ -0,0 +1,36 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: response-header-route
+      responseHeadersToAdd:
+      - header:
+          key: some-header
+          value: some-value
+      - header:
+          key: some-header-2
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header3
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header4
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: empty-header
+        keepEmptyValue: true
+      responseHeadersToRemove:
+      - some-header5
+      - some-header6
+      route:
+        cluster: response-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.clusters.yaml
new file mode 100644
index 000000000..ca020e482
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: response-header-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: response-header-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.endpoints.yaml
new file mode 100644
index 000000000..d21491f62
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: response-header-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: response-header-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml
new file mode 100644
index 000000000..58a4e2720
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml
@@ -0,0 +1,17 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: response-header-route
+      responseHeadersToRemove:
+      - some-header5
+      - some-header6
+      route:
+        cluster: response-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.clusters.yaml
new file mode 100644
index 000000000..027db39fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: rewrite-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: rewrite-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.endpoints.yaml
new file mode 100644
index 000000000..256dda090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: rewrite-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: rewrite-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.routes.yaml
new file mode 100644
index 000000000..d5a0bd989
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.routes.yaml
@@ -0,0 +1,22 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - gateway.envoyproxy.io
+    name: first-listener/gateway_envoyproxy_io
+    routes:
+    - match:
+        headers:
+        - name: :authority
+          stringMatch:
+            exact: gateway.envoyproxy.io
+        pathSeparatedPrefix: /origin
+      name: rewrite-route
+      route:
+        cluster: rewrite-route-dest
+        regexRewrite:
+          pattern:
+            regex: ^/origin/\/*
+          substitution: /
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.clusters.yaml
new file mode 100644
index 000000000..3a2b7308d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: rewrite-route
+  lbPolicy: LEAST_REQUEST
+  name: rewrite-route
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.endpoints.yaml
new file mode 100644
index 000000000..ca1ef21c9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: rewrite-route
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: rewrite-route/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.routes.yaml
new file mode 100644
index 000000000..f8b81712d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - gateway.envoyproxy.io
+    name: first-listener/gateway_envoyproxy_io
+    routes:
+    - match:
+        pathSeparatedPrefix: /origin
+      name: rewrite-route
+      route:
+        cluster: rewrite-route
+        regexRewrite:
+          pattern:
+            regex: /.+
+          substitution: /rewrite
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.clusters.yaml
new file mode 100644
index 000000000..027db39fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: rewrite-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: rewrite-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.endpoints.yaml
new file mode 100644
index 000000000..256dda090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: rewrite-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: rewrite-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.routes.yaml
new file mode 100644
index 000000000..680a67404
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.routes.yaml
@@ -0,0 +1,21 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - gateway.envoyproxy.io
+    name: first-listener/gateway_envoyproxy_io
+    routes:
+    - match:
+        headers:
+        - name: :authority
+          stringMatch:
+            exact: gateway.envoyproxy.io
+        pathSeparatedPrefix: /origin
+      name: rewrite-route
+      route:
+        appendXForwardedHost: true
+        cluster: rewrite-route-dest
+        hostRewriteLiteral: 3.3.3.3
+        prefixRewrite: /rewrite
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.clusters.yaml
new file mode 100644
index 000000000..027db39fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: rewrite-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: rewrite-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.endpoints.yaml
new file mode 100644
index 000000000..256dda090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: rewrite-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: rewrite-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.routes.yaml
new file mode 100644
index 000000000..84bc70f04
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.routes.yaml
@@ -0,0 +1,19 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - gateway.envoyproxy.io
+    name: first-listener/gateway_envoyproxy_io
+    routes:
+    - match:
+        headers:
+        - name: :authority
+          stringMatch:
+            exact: gateway.envoyproxy.io
+        pathSeparatedPrefix: /origin
+      name: rewrite-route
+      route:
+        cluster: rewrite-route-dest
+        prefixRewrite: /rewrite
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.clusters.yaml
new file mode 100644
index 000000000..a89644e62
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.clusters.yaml
@@ -0,0 +1,51 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.endpoints.yaml
new file mode 100644
index 000000000..42a346c40
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.endpoints.yaml
@@ -0,0 +1,36 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50002
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml
new file mode 100644
index 000000000..23d2bf4b7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml
@@ -0,0 +1,38 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        idleTimeout: 3600s
+        timeout: 5s
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        idleTimeout: 4000s
+        timeout: 4000s
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: third-route
+      route:
+        cluster: third-route-dest
+        idleTimeout: 0s
+        timeout: 0s
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.endpoints.yaml
new file mode 100644
index 000000000..f5633bd15
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.endpoints.yaml
@@ -0,0 +1,42 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.1.1.1
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: first-route-dest/backend/0
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 2.2.2.2
+            portValue: 50002
+      loadBalancingWeight: 1
+    loadBalancingWeight: 40
+    locality:
+      region: first-route-dest/backend/1
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 3.3.3.3
+            portValue: 50003
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: first-route-dest/backend/2
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 4.4.4.4
+            portValue: 50004
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: first-route-dest/backend/3
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml
new file mode 100644
index 000000000..235dea427
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml
@@ -0,0 +1,20 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
+        upgradeConfigs:
+        - upgradeType: websocket
+        weightedClusters:
+          clusters:
+          - name: invalid-backend-cluster
+            weight: 1
+          - name: first-route-dest
+            weight: 1
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.clusters.yaml
new file mode 100644
index 000000000..2c908f7ef
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.clusters.yaml
@@ -0,0 +1,13 @@
+- commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route
+  name: first-route
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.listeners.yaml
new file mode 100644
index 000000000..9f0e050cf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.listeners.yaml
@@ -0,0 +1,30 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        upgradeConfigs:
+        - upgradeType: websocket
+        useRemoteAddress: true
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml
new file mode 100644
index 000000000..670a5464e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml
@@ -0,0 +1,30 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/envoy-gateway/httproute-btls/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/envoy-gateway/httproute-btls/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  transportSocketMatches:
+  - match:
+      name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          validationContext:
+            trustedCa:
+              filename: /etc/ssl/certs/ca-certificates.crt
+        sni: example.com
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.endpoints.yaml
new file mode 100644
index 000000000..3d0e81607
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.endpoints.yaml
@@ -0,0 +1,16 @@
+- clusterName: httproute/envoy-gateway/httproute-btls/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.11
+            portValue: 8080
+      loadBalancingWeight: 1
+      metadata:
+        filterMetadata:
+          envoy.transport_socket_match:
+            name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls/rule/0/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.listeners.yaml
new file mode 100644
index 000000000..0f95e32bd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-btls/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: envoy-gateway/gateway-btls/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.routes.yaml
new file mode 100644
index 000000000..bd4f9cfe7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-btls/http
+  virtualHosts:
+  - domains:
+    - '*'
+    name: envoy-gateway/gateway-btls/http/*
+    routes:
+    - match:
+        path: /exact
+      name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+      route:
+        cluster: httproute/envoy-gateway/httproute-btls/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml
new file mode 100755
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.clusters.yaml
new file mode 100755
index 000000000..8a7225b4c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.clusters.yaml
@@ -0,0 +1,94 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/envoy-gateway/httproute-btls/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/envoy-gateway/httproute-btls/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  transportSocketMatches:
+  - match:
+      name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          validationContextSdsSecretConfig:
+            name: policy-btls/policies-ca2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+        sni: bar.example.com
+  - match:
+      name: httproute/envoy-gateway/httproute-btls/rule/0/tls/1
+    name: httproute/envoy-gateway/httproute-btls/rule/0/tls/1
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          validationContextSdsSecretConfig:
+            name: policy-btls/policies-ca
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+        sni: example.com
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/envoy-gateway/httproute-btls-2/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/envoy-gateway/httproute-btls-2/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  transportSocket:
+    name: envoy.transport_sockets.upstream_proxy_protocol
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
+      config:
+        version: V2
+      transportSocket:
+        name: envoy.transport_sockets.raw_buffer
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
+  transportSocketMatches:
+  - match:
+      name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/1
+    name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/1
+    transportSocket:
+      name: envoy.transport_sockets.upstream_proxy_protocol
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
+        config:
+          version: V2
+        transportSocket:
+          name: envoy.transport_sockets.tls
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+            commonTlsContext:
+              validationContextSdsSecretConfig:
+                name: policy-btls-2/policies-ca
+                sdsConfig:
+                  ads: {}
+                  resourceApiVersion: V3
+            sni: example.com
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.endpoints.yaml
new file mode 100755
index 000000000..94a0deb06
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.endpoints.yaml
@@ -0,0 +1,56 @@
+- clusterName: httproute/envoy-gateway/httproute-btls/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.12
+            portValue: 8080
+      loadBalancingWeight: 1
+      metadata:
+        filterMetadata:
+          envoy.transport_socket_match:
+            name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls/rule/0/backend/0
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.11
+            portValue: 8080
+      loadBalancingWeight: 1
+      metadata:
+        filterMetadata:
+          envoy.transport_socket_match:
+            name: httproute/envoy-gateway/httproute-btls/rule/0/tls/1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls/rule/0/backend/1
+- clusterName: httproute/envoy-gateway/httproute-btls-2/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.12
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls-2/rule/0/backend/0
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.11
+            portValue: 8080
+      loadBalancingWeight: 1
+      metadata:
+        filterMetadata:
+          envoy.transport_socket_match:
+            name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls-2/rule/0/backend/1
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.listeners.yaml
new file mode 100755
index 000000000..8e0e6200c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.listeners.yaml
@@ -0,0 +1,66 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-btls/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: envoy-gateway/gateway-btls/http
+  perConnectionBufferLimitBytes: 32768
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10081
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-btls-2/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: envoy-gateway/gateway-btls-2/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.routes.yaml
new file mode 100755
index 000000000..1d716e5c2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.routes.yaml
@@ -0,0 +1,28 @@
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-btls/http
+  virtualHosts:
+  - domains:
+    - '*'
+    name: envoy-gateway/gateway-btls/http/*
+    routes:
+    - match:
+        path: /exact
+      name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+      route:
+        cluster: httproute/envoy-gateway/httproute-btls/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-btls-2/http
+  virtualHosts:
+  - domains:
+    - '*'
+    name: envoy-gateway/gateway-btls-2/http/*
+    routes:
+    - match:
+        path: /exact
+      name: httproute/envoy-gateway/httproute-btls-2/rule/0/match/0/*
+      route:
+        cluster: httproute/envoy-gateway/httproute-btls-2/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.secrets.yaml
new file mode 100755
index 000000000..6e227be87
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.secrets.yaml
@@ -0,0 +1,12 @@
+- name: policy-btls/policies-ca2
+  validationContext:
+    trustedCa:
+      inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+- name: policy-btls/policies-ca
+  validationContext:
+    trustedCa:
+      inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+- name: policy-btls-2/policies-ca
+  validationContext:
+    trustedCa:
+      inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.clusters.yaml
new file mode 100644
index 000000000..695386bb2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.clusters.yaml
@@ -0,0 +1,32 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/envoy-gateway/httproute-btls/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/envoy-gateway/httproute-btls/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  transportSocketMatches:
+  - match:
+      name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          validationContextSdsSecretConfig:
+            name: policy-btls/policies-ca
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+        sni: example.com
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.endpoints.yaml
new file mode 100644
index 000000000..3d0e81607
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.endpoints.yaml
@@ -0,0 +1,16 @@
+- clusterName: httproute/envoy-gateway/httproute-btls/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.11
+            portValue: 8080
+      loadBalancingWeight: 1
+      metadata:
+        filterMetadata:
+          envoy.transport_socket_match:
+            name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls/rule/0/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.listeners.yaml
new file mode 100644
index 000000000..0f95e32bd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-btls/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: envoy-gateway/gateway-btls/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.routes.yaml
new file mode 100644
index 000000000..bd4f9cfe7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-btls/http
+  virtualHosts:
+  - domains:
+    - '*'
+    name: envoy-gateway/gateway-btls/http/*
+    routes:
+    - match:
+        path: /exact
+      name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+      route:
+        cluster: httproute/envoy-gateway/httproute-btls/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.secrets.yaml
new file mode 100644
index 000000000..be757009c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.secrets.yaml
@@ -0,0 +1,4 @@
+- name: policy-btls/policies-ca
+  validationContext:
+    trustedCa:
+      inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.routes.yaml
new file mode 100644
index 000000000..7030f6f4c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.routes.yaml
@@ -0,0 +1,25 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        - name: test
+          stringMatch:
+            suffix: end
+        prefix: /
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.clusters.yaml
new file mode 100644
index 000000000..1489e95f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.clusters.yaml
@@ -0,0 +1,55 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        httpProtocolOptions:
+          headerKeyFormat:
+            statefulFormatter:
+              name: preserve_case
+              typedConfig:
+                '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        httpProtocolOptions:
+          enableTrailers: true
+          headerKeyFormat:
+            statefulFormatter:
+              name: preserve_case
+              typedConfig:
+                '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.endpoints.yaml
new file mode 100644
index 000000000..28a57caf3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.endpoints.yaml
@@ -0,0 +1,24 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.5
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml
new file mode 100644
index 000000000..b3b279d84
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml
@@ -0,0 +1,79 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        httpProtocolOptions:
+          headerKeyFormat:
+            statefulFormatter:
+              name: preserve_case
+              typedConfig:
+                '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10081
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        httpProtocolOptions:
+          enableTrailers: true
+          headerKeyFormat:
+            statefulFormatter:
+              name: preserve_case
+              typedConfig:
+                '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: second-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: second-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml
new file mode 100644
index 000000000..ff93cfff3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml
@@ -0,0 +1,28 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: second-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: second-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.clusters.yaml
new file mode 100644
index 000000000..8c3dd7a54
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.clusters.yaml
@@ -0,0 +1,23 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        httpProtocolOptions:
+          enableTrailers: true
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml
new file mode 100644
index 000000000..06b72b5ac
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml
@@ -0,0 +1,35 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        httpProtocolOptions:
+          enableTrailers: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.clusters.yaml
new file mode 100644
index 000000000..2cb022cfa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.clusters.yaml
@@ -0,0 +1,24 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        httpProtocolOptions:
+          acceptHttp10: true
+          defaultHostForHttp10: foo.com
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.listeners.yaml
new file mode 100644
index 000000000..ebd95e6e6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.listeners.yaml
@@ -0,0 +1,36 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        httpProtocolOptions:
+          acceptHttp10: true
+          defaultHostForHttp10: foo.com
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.clusters.yaml
new file mode 100644
index 000000000..6086cfbb8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.clusters.yaml
@@ -0,0 +1,22 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.listeners.yaml
new file mode 100644
index 000000000..f88559717
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.listeners.yaml
@@ -0,0 +1,41 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.grpc_web
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
+        - name: envoy.filters.http.grpc_stats
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
+            emitFilterState: true
+            statsForAllMethods: true
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.routes.yaml
new file mode 100644
index 000000000..a32852fcd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.routes.yaml
@@ -0,0 +1,22 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        path: foo/bar
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.clusters.yaml
new file mode 100644
index 000000000..9714612e3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-1/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-1/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.endpoints.yaml
new file mode 100644
index 000000000..29bb6b4e4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: httproute/default/httproute-1/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-1/rule/0/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.listeners.yaml
new file mode 100644
index 000000000..277b2065a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.listeners.yaml
@@ -0,0 +1,99 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10443
+      protocol: UDP
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        codecType: HTTP3
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        http3ProtocolOptions: {}
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-1/tls
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.quic
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.quic.v3.QuicDownstreamTransport
+        downstreamTlsContext:
+          commonTlsContext:
+            alpnProtocols:
+            - h2
+            - http/1.1
+            - h3
+            tlsCertificateSdsSecretConfigs:
+            - name: envoy-gateway-tls-secret-1
+              sdsConfig:
+                ads: {}
+                resourceApiVersion: V3
+  name: envoy-gateway/gateway-1/tls-quic
+  udpListenerConfig:
+    downstreamSocketConfig: {}
+    quicOptions: {}
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10443
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-1/tls
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: envoy-gateway-tls-secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: envoy-gateway/gateway-1/tls
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.routes.yaml
new file mode 100644
index 000000000..f3e513cea
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.routes.yaml
@@ -0,0 +1,19 @@
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-1/tls
+  virtualHosts:
+  - domains:
+    - '*'
+    name: envoy-gateway/gateway-1/tls/*
+    routes:
+    - match:
+        prefix: /
+      name: httproute/default/httproute-1/rule/0/match/0/*
+      responseHeadersToAdd:
+      - append: true
+        header:
+          key: alt-svc
+          value: h3=":443"; ma=86400
+      route:
+        cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.secrets.yaml
new file mode 100644
index 000000000..d4d502ac0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.secrets.yaml
@@ -0,0 +1,6 @@
+- name: envoy-gateway-tls-secret-1
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNxRENDQVpBQ0NRREVNZ1lZblFyQ29EQU5CZ2txaGtpRzl3MEJBUXNGQURBV01SUXdFZ1lEVlFRRERBdG0KYjI4dVltRnlMbU52YlRBZUZ3MHlNekF4TURVeE16UXpNalJhRncweU5EQXhNRFV4TXpRek1qUmFNQll4RkRBUwpCZ05WQkFNTUMyWnZieTVpWVhJdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDCkFRRUFuZEh6d21wS2NUSUViamhGZ2RXd1RSTjc1Y3A4b3VsWnhMMUdydlI2SXc3ejdqaTBSNFcvTm85bkdmOU0KWVAyQ1JqaXN6NTFtd3hTeGVCcm9jTGVBK21reGkxK2lEdk5kQytyU0x4MTN6RUxTQ25xYnVzUHM3bUdmSlpxOAo5TGhlbmx5bzQzaDVjYTZINUxqTXd1L1JHVWlGMzFYck5yaVlGQlB2RTJyQitkd24vTkVrUTRoOFJxcXlwcmtuCkYvcWM5Sk1ZQVlGRld1VkNwa0lFbmRYMUN5dlFOT2FkZmN2cmd6dDV2SmwwT2kxQWdyaU5hWGJFUEdudWY3STQKcXBCSEdVWE5lMVdsOVdlVklxS1g0T2FFWERWQzZGQzdHOHptZWVMVzFBa1lFVm5pcFg2b1NCK0JjL1NIVlZOaApzQkxSbXRuc3pmTnRUMlFyZCttcGt4ODBaUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1VKOElDCkJveUVqT3V3enBHYVJoR044QjRqT1B6aHVDT0V0ZDM3UzAybHUwN09IenlCdmJzVEd6S3dCZ0x5bVdmR2tINEIKajdDTHNwOEZ6TkhLWnVhQmdwblo5SjZETE9Od2ZXZTJBWXA3TGRmT0tWQlVkTVhRaU9tN2pKOUhob0Ntdk1ONwpic2pjaFdKb013ckZmK3dkQUthdHowcUFQeWhMeWUvRnFtaVZ4a09SWmF3K1Q5bURaK0g0OXVBU2d1SnVOTXlRClY2RXlYNmd0Z1dxMzc2SHZhWE1TLzNoYW1Zb1ZXWEk1TXhpUE9ZeG5BQmtKQjRTQ2dJUmVqYkpmVmFRdG9RNGEKejAyaVVMZW5ESUllUU9Zb2JLY01CWGYxQjRQQVFtc2VocVZJYnpzUUNHaTU0VkRyczZiWmQvN0pzMXpDcHBncwpKaUQ1SXFNaktXRHdxN2FLCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    privateKey:
+      inlineBytes: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.envoypatchpolicies.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.envoypatchpolicies.yaml
new file mode 100644
index 000000000..55cdd5c4c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.envoypatchpolicies.yaml
@@ -0,0 +1,9 @@
+- name: first-policy
+  namespace: default
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The add operation requires a value
+      reason: Invalid
+      status: "False"
+      type: Programmed
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
new file mode 100644
index 000000000..03bb654b4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
@@ -0,0 +1,50 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml
new file mode 100644
index 000000000..4a412b357
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml
new file mode 100644
index 000000000..4a412b357
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.envoypatchpolicies.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.envoypatchpolicies.yaml
new file mode 100644
index 000000000..26d7c0af4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.envoypatchpolicies.yaml
@@ -0,0 +1,10 @@
+- name: first-policy
+  namespace: default
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: 'unable to find xds resource type.googleapis.com/envoy.config.listener.v3.Listener:
+        non-existant-listener'
+      reason: ResourceNotFound
+      status: "False"
+      type: Programmed
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml
new file mode 100644
index 000000000..4a412b357
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.envoypatchpolicies.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.envoypatchpolicies.yaml
new file mode 100644
index 000000000..fd7728081
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.envoypatchpolicies.yaml
@@ -0,0 +1,9 @@
+- name: first-policy
+  namespace: default
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The value field can not be set for the remove operation
+      reason: Invalid
+      status: "False"
+      type: Programmed
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
new file mode 100644
index 000000000..03bb654b4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
@@ -0,0 +1,50 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml
new file mode 100644
index 000000000..4a412b357
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.envoypatchpolicies.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.envoypatchpolicies.yaml
new file mode 100644
index 000000000..4043644d4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.envoypatchpolicies.yaml
@@ -0,0 +1,9 @@
+- name: first-policy
+  namespace: default
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: successfully applied patches.
+      reason: Programmed
+      status: "True"
+      type: Programmed
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml
new file mode 100644
index 000000000..03bb654b4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml
@@ -0,0 +1,50 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.routes.yaml
new file mode 100644
index 000000000..4a412b357
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.secrets.yaml
new file mode 100644
index 000000000..d1c4b32fd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.secrets.yaml
@@ -0,0 +1,16 @@
+- name: secret-1
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: a2V5LWRhdGE=
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: secret-2
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: test_secret
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml
new file mode 100644
index 000000000..729a0304a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml
@@ -0,0 +1,60 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  listenerFilters:
+  - name: envoy.filters.listener.proxy_protocol
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.clusters.yaml
new file mode 100644
index 000000000..a52251e32
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.clusters.yaml
@@ -0,0 +1,68 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tls-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: tls-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.endpoints.yaml
new file mode 100644
index 000000000..5b4fe89e5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.endpoints.yaml
@@ -0,0 +1,48 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: tls-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tls-route-dest/backend/0
+- clusterName: tcp-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml
new file mode 100644
index 000000000..d73eb9293
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml
@@ -0,0 +1,137 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
+  socketOptions:
+  - description: socket option to enable tcp keep alive
+    intValue: "1"
+    level: "1"
+    name: "9"
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10081
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: second-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: second-listener
+  perConnectionBufferLimitBytes: 32768
+  socketOptions:
+  - description: socket option to enable tcp keep alive
+    intValue: "1"
+    level: "1"
+    name: "9"
+  - description: socket option for keep alive probes
+    intValue: "7"
+    level: "6"
+    name: "6"
+  - description: socket option for keep alive idle time
+    intValue: "50"
+    level: "6"
+    name: "4"
+  - description: socket option for keep alive interval
+    intValue: "200"
+    level: "6"
+    name: "5"
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10082
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - bar.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tls-route-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: third-listener
+  perConnectionBufferLimitBytes: 32768
+  socketOptions:
+  - description: socket option to enable tcp keep alive
+    intValue: "1"
+    level: "1"
+    name: "9"
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10083
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-dest
+        statPrefix: tcp
+  name: fourth-listener
+  perConnectionBufferLimitBytes: 32768
+  socketOptions:
+  - description: socket option to enable tcp keep alive
+    intValue: "1"
+    level: "1"
+    name: "9"
+  - description: socket option for keep alive probes
+    intValue: "10"
+    level: "6"
+    name: "6"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml
new file mode 100644
index 000000000..ff93cfff3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml
@@ -0,0 +1,28 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: second-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: second-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.clusters.yaml
new file mode 100644
index 000000000..fc755fed3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.clusters.yaml
@@ -0,0 +1,106 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: RANDOM
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fourth-route-dest
+  lbPolicy: MAGLEV
+  name: fourth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fifth-route-dest
+  lbPolicy: LEAST_REQUEST
+  leastRequestLbConfig:
+    slowStartConfig:
+      slowStartWindow: 60s
+  name: fifth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: sixth-route-dest
+  name: sixth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  roundRobinLbConfig:
+    slowStartConfig:
+      slowStartWindow: 300s
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.endpoints.yaml
new file mode 100644
index 000000000..ee22b49d2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.endpoints.yaml
@@ -0,0 +1,72 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
+- clusterName: fourth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fourth-route-dest/backend/0
+- clusterName: fifth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fifth-route-dest/backend/0
+- clusterName: sixth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: sixth-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.routes.yaml
new file mode 100644
index 000000000..49db59653
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.routes.yaml
@@ -0,0 +1,52 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: third-route
+      route:
+        cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: fourth-route
+      route:
+        cluster: fourth-route-dest
+        hashPolicy:
+        - connectionProperties:
+            sourceIp: true
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: fifth-route
+      route:
+        cluster: fifth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: sixth-route
+      route:
+        cluster: sixth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml
new file mode 100644
index 000000000..41594a227
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml
@@ -0,0 +1,20 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    virtualClusters:
+    - headers:
+      - name: :authority
+        stringMatch:
+          prefix: '*'
+      name: '*'
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.clusters.yaml
new file mode 100644
index 000000000..7a0c93317
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.clusters.yaml
@@ -0,0 +1,45 @@
+- commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: localhost_443
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: localhost
+              portValue: 443
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality: {}
+  name: localhost_443
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  transportSocket:
+    name: envoy.transport_sockets.tls
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+      commonTlsContext:
+        validationContext:
+          trustedCa:
+            filename: /etc/ssl/certs/ca-certificates.crt
+  type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.endpoints.yaml
new file mode 100644
index 000000000..0d68b430c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.endpoints.yaml
@@ -0,0 +1,11 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.listeners.yaml
new file mode 100644
index 000000000..f090a8d12
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.listeners.yaml
@@ -0,0 +1,67 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.jwt_authn
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
+            providers:
+              first-route/example:
+                audiences:
+                - foo.com
+                issuer: https://www.example.com
+                payloadInMetadata: https://www.example.com
+                remoteJwks:
+                  asyncFetch: {}
+                  cacheDuration: 300s
+                  httpUri:
+                    cluster: localhost_443
+                    timeout: 5s
+                    uri: https://localhost/jwt/public-key/jwks.json
+                  retryPolicy: {}
+            requirementMap:
+              first-route:
+                providerName: first-route/example
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        upgradeConfigs:
+        - upgradeType: websocket
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: first-listener
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.routes.yaml
new file mode 100644
index 000000000..c73bec090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.routes.yaml
@@ -0,0 +1,16 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo/bar
+      name: first-route
+      route:
+        cluster: first-route-dest
+      typedPerFilterConfig:
+        envoy.filters.http.jwt_authn:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
+          requirementName: first-route
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.secrets.yaml
new file mode 100644
index 000000000..9155e5c88
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.secrets.yaml
@@ -0,0 +1,6 @@
+- name: first-listener
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.clusters.yaml
new file mode 100755
index 000000000..2b9b567cf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.clusters.yaml
@@ -0,0 +1,104 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-1/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-1/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-2/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-2/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+  lbPolicy: LEAST_REQUEST
+  name: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-3/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-3/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: oauth_foo_com_443
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: oauth.foo.com
+              portValue: 443
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: oauth_foo_com_443/backend/0
+  name: oauth_foo_com_443
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  transportSocket:
+    name: envoy.transport_sockets.tls
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+      commonTlsContext:
+        validationContext:
+          trustedCa:
+            filename: /etc/ssl/certs/ca-certificates.crt
+      sni: oauth.foo.com
+  type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.endpoints.yaml
new file mode 100755
index 000000000..1f4fcb70d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.endpoints.yaml
@@ -0,0 +1,48 @@
+- clusterName: httproute/default/httproute-1/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 192.168.1.1
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-1/rule/0/backend/0
+- clusterName: httproute/default/httproute-2/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 192.168.1.2
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-2/rule/0/backend/0
+- clusterName: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 80
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend/backend/0
+- clusterName: httproute/default/httproute-3/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 192.168.1.3
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-3/rule/0/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml
new file mode 100755
index 000000000..910c6728e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml
@@ -0,0 +1,156 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+      protocol: UDP
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        codecType: HTTP3
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        http3ProtocolOptions: {}
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_foo_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            httpService:
+              authorizationResponse:
+                allowedUpstreamHeaders:
+                  patterns:
+                  - exact: header1
+                  - exact: header2
+              pathPrefix: /auth
+              serverUri:
+                cluster: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+                timeout: 10s
+                uri: http://http-backend.envoy-gateway:80/auth
+            transportApiVersion: V3
+        - disabled: true
+          name: envoy.filters.http.basic_auth_httproute/default/httproute-1/rule/0/match/0/www_foo_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
+            users:
+              inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: default/gateway-1/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: default/gateway-1/http-quic
+  udpListenerConfig:
+    downstreamSocketConfig: {}
+    quicOptions: {}
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_foo_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            httpService:
+              authorizationResponse:
+                allowedUpstreamHeaders:
+                  patterns:
+                  - exact: header1
+                  - exact: header2
+              pathPrefix: /auth
+              serverUri:
+                cluster: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+                timeout: 10s
+                uri: http://http-backend.envoy-gateway:80/auth
+            transportApiVersion: V3
+        - disabled: true
+          name: envoy.filters.http.basic_auth_httproute/default/httproute-1/rule/0/match/0/www_foo_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
+            users:
+              inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
+        - disabled: true
+          name: envoy.filters.http.oauth2_httproute/default/httproute-3/rule/0/match/0/www_bar_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.oauth2.v3.OAuth2
+            config:
+              authScopes:
+              - openid
+              - email
+              - profile
+              authType: BASIC_AUTH
+              authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+              credentials:
+                clientId: client.oauth.foo.com
+                cookieNames:
+                  bearerToken: BearerToken-5F93C2E4
+                  idToken: IdToken-5F93C2E4
+                  oauthExpires: OauthExpires-5F93C2E4
+                  oauthHmac: OauthHMAC-5F93C2E4
+                  refreshToken: RefreshToken-5F93C2E4
+                hmacSecret:
+                  name: httproute/default/httproute-3/rule/0/match/0/www_bar_com/oauth2/hmac_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+                tokenSecret:
+                  name: httproute/default/httproute-3/rule/0/match/0/www_bar_com/oauth2/client_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+              forwardBearerToken: true
+              redirectPathMatcher:
+                path:
+                  exact: /foo/oauth2/callback
+              redirectUri: https://www.example.com/foo/oauth2/callback
+              signoutPath:
+                path:
+                  exact: /foo/logout
+              tokenEndpoint:
+                cluster: oauth_foo_com_443
+                timeout: 10s
+                uri: https://oauth.foo.com/token
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: default/gateway-1/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: default/gateway-1/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml
new file mode 100755
index 000000000..1a4ec4068
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml
@@ -0,0 +1,54 @@
+- ignorePortInHostMatching: true
+  name: default/gateway-1/http
+  virtualHosts:
+  - domains:
+    - www.foo.com
+    name: default/gateway-1/http/www_foo_com
+    routes:
+    - match:
+        pathSeparatedPrefix: /foo1
+      name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+      responseHeadersToAdd:
+      - append: true
+        header:
+          key: alt-svc
+          value: h3=":443"; ma=86400
+      route:
+        cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.basic_auth_httproute/default/httproute-1/rule/0/match/0/www_foo_com:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+    - match:
+        pathSeparatedPrefix: /foo2
+      name: httproute/default/httproute-2/rule/0/match/0/www_foo_com
+      responseHeadersToAdd:
+      - append: true
+        header:
+          key: alt-svc
+          value: h3=":443"; ma=86400
+      route:
+        cluster: httproute/default/httproute-2/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_foo_com:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+  - domains:
+    - www.bar.com
+    name: default/gateway-2/http/www_bar_com
+    routes:
+    - match:
+        pathSeparatedPrefix: /bar
+      name: httproute/default/httproute-3/rule/0/match/0/www_bar_com
+      route:
+        cluster: httproute/default/httproute-3/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.oauth2_httproute/default/httproute-3/rule/0/match/0/www_bar_com:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.clusters.yaml
new file mode 100644
index 000000000..ce7f4361a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.clusters.yaml
@@ -0,0 +1,102 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fourth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: fourth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tls-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: tls-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.endpoints.yaml
new file mode 100644
index 000000000..ceed007af
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.endpoints.yaml
@@ -0,0 +1,72 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
+- clusterName: fourth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fourth-route-dest/backend/0
+- clusterName: tcp-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-dest/backend/0
+- clusterName: tls-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tls-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml
new file mode 100644
index 000000000..170017bc4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml
@@ -0,0 +1,138 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: third-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: first-listener
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  - filterChainMatch:
+      serverNames:
+      - foo.net
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: second-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: second-listener
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  - filterChainMatch:
+      serverNames:
+      - bar.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-dest
+        statPrefix: passthrough
+  - filterChainMatch:
+      serverNames:
+      - bar.net
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tls-route-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml
new file mode 100644
index 000000000..c94d2c09f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml
@@ -0,0 +1,53 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: second-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: second-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: third-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: third-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: third-route
+      route:
+        cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - '*'
+    name: fourth-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: fourth-route
+      route:
+        cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.secrets.yaml
new file mode 100644
index 000000000..47ebba746
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.secrets.yaml
@@ -0,0 +1,12 @@
+- name: first-listener
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: second-listener
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.clusters.yaml
new file mode 100644
index 000000000..e0f57c2a6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.clusters.yaml
@@ -0,0 +1,85 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-1-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-1-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-2-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-2-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-3-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-3-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-4-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-4-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.endpoints.yaml
new file mode 100644
index 000000000..8d9b5f227
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.endpoints.yaml
@@ -0,0 +1,90 @@
+- clusterName: tcp-route-simple-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-dest/backend/0
+- clusterName: tcp-route-simple-1-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-1-dest/backend/0
+- clusterName: tcp-route-simple-2-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-2-dest/backend/0
+- clusterName: tcp-route-simple-3-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-3-dest/backend/0
+- clusterName: tcp-route-simple-4-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-4-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.listeners.yaml
new file mode 100644
index 000000000..33e4073d8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.listeners.yaml
@@ -0,0 +1,38 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-dest
+        statPrefix: tcp
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-1-dest
+        statPrefix: tcp
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-2-dest
+        statPrefix: tcp
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-3-dest
+        statPrefix: tcp
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-4-dest
+        statPrefix: tcp
+  name: tcp-route-simple
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml
new file mode 100644
index 000000000..80a48e25b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml
@@ -0,0 +1,56 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          validationContextSdsSecretConfig:
+            name: ca-cert
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+        requireClientCertificate: true
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.secrets.yaml
new file mode 100644
index 000000000..052882baf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.secrets.yaml
@@ -0,0 +1,16 @@
+- name: secret-1
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: secret-2
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: ca-cert
+  validationContext:
+    trustedCa:
+      inlineBytes: Y2VydC1kYXRh
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.clusters.yaml
new file mode 100644
index 000000000..5309331d0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.clusters.yaml
@@ -0,0 +1,106 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: oauth_foo_com_443
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: oauth.foo.com
+              portValue: 443
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: oauth_foo_com_443/backend/0
+  name: oauth_foo_com_443
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  transportSocket:
+    name: envoy.transport_sockets.tls
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+      commonTlsContext:
+        validationContext:
+          trustedCa:
+            filename: /etc/ssl/certs/ca-certificates.crt
+      sni: oauth.foo.com
+  type: STRICT_DNS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: oauth_bar_com_443
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: oauth.bar.com
+              portValue: 443
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: oauth_bar_com_443/backend/0
+  name: oauth_bar_com_443
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  transportSocket:
+    name: envoy.transport_sockets.tls
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+      commonTlsContext:
+        validationContext:
+          trustedCa:
+            filename: /etc/ssl/certs/ca-certificates.crt
+      sni: oauth.bar.com
+  type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.endpoints.yaml
new file mode 100644
index 000000000..de95bf555
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.endpoints.yaml
@@ -0,0 +1,24 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.listeners.yaml
new file mode 100644
index 000000000..4d4721c66
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.listeners.yaml
@@ -0,0 +1,115 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.oauth2_first-route
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.oauth2.v3.OAuth2
+            config:
+              authScopes:
+              - openid
+              - email
+              - profile
+              authType: BASIC_AUTH
+              authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+              credentials:
+                clientId: client.oauth.foo.com
+                cookieNames:
+                  bearerToken: BearerToken-5F93C2E4
+                  idToken: IdToken-5F93C2E4
+                  oauthExpires: OauthExpires-5F93C2E4
+                  oauthHmac: OauthHMAC-5F93C2E4
+                  refreshToken: RefreshToken-5F93C2E4
+                hmacSecret:
+                  name: first-route/oauth2/hmac_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+                tokenSecret:
+                  name: first-route/oauth2/client_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+              forwardBearerToken: true
+              redirectPathMatcher:
+                path:
+                  exact: /foo/oauth2/callback
+              redirectUri: https://www.example.com/foo/oauth2/callback
+              signoutPath:
+                path:
+                  exact: /foo/logout
+              tokenEndpoint:
+                cluster: oauth_foo_com_443
+                timeout: 10s
+                uri: https://oauth.foo.com/token
+        - disabled: true
+          name: envoy.filters.http.oauth2_second-route
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.oauth2.v3.OAuth2
+            config:
+              authScopes:
+              - openid
+              - email
+              - profile
+              authType: BASIC_AUTH
+              authorizationEndpoint: https://oauth.bar.com/oauth2/v2/auth
+              credentials:
+                clientId: client.oauth.bar.com
+                cookieNames:
+                  bearerToken: BearerToken-5f93c2e4
+                  idToken: IdToken-5f93c2e4
+                  oauthExpires: OauthExpires-5f93c2e4
+                  oauthHmac: OauthHMAC-5f93c2e4
+                  refreshToken: RefreshToken-5f93c2e4
+                hmacSecret:
+                  name: second-route/oauth2/hmac_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+                tokenSecret:
+                  name: second-route/oauth2/client_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+              forwardBearerToken: true
+              redirectPathMatcher:
+                path:
+                  exact: /bar/oauth2/callback
+              redirectUri: https://www.example.com/bar/oauth2/callback
+              signoutPath:
+                path:
+                  exact: /bar/logout
+              tokenEndpoint:
+                cluster: oauth_bar_com_443
+                timeout: 10s
+                uri: https://oauth.bar.com/token
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.routes.yaml
new file mode 100644
index 000000000..a093d6967
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.routes.yaml
@@ -0,0 +1,29 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.oauth2_first-route:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+    - match:
+        path: bar
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.oauth2_second-route:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.listeners.yaml
new file mode 100644
index 000000000..02167bb10
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.listeners.yaml
@@ -0,0 +1,32 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.clusters.yaml
new file mode 100644
index 000000000..6441952ea
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.clusters.yaml
@@ -0,0 +1,27 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  transportSocket:
+    name: envoy.transport_sockets.upstream_proxy_protocol
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
+      config:
+        version: V2
+      transportSocket:
+        name: envoy.transport_sockets.raw_buffer
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml
new file mode 100644
index 000000000..f2cacab52
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml
@@ -0,0 +1,53 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        retryPolicy:
+          hostSelectionRetryMaxAttempts: "5"
+          numRetries: 5
+          perTryTimeout: 0.250s
+          retriableStatusCodes:
+          - 429
+          - 503
+          retryBackOff:
+            baseInterval: 0.100s
+            maxInterval: 10s
+          retryHostPredicate:
+          - name: envoy.retry_host_predicates.previous_hosts
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate
+          retryOn: reset,connect-failure,retriable-status-codes
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - foo
+    name: first-listener/foo
+    routes:
+    - match:
+        prefix: /
+      name: second-route-defaults
+      route:
+        cluster: first-route-dest
+        retryPolicy:
+          hostSelectionRetryMaxAttempts: "5"
+          numRetries: 2
+          retriableStatusCodes:
+          - 503
+          retryHostPredicate:
+          - name: envoy.retry_host_predicates.previous_hosts
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate
+          retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - bar
+    name: first-listener/bar
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.listeners.yaml
new file mode 100644
index 000000000..03bb654b4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.listeners.yaml
@@ -0,0 +1,50 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.secrets.yaml
new file mode 100644
index 000000000..ad88ffe43
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.secrets.yaml
@@ -0,0 +1,12 @@
+- name: secret-1
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: secret-2
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml
new file mode 100644
index 000000000..d4e9eb359
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml
@@ -0,0 +1,56 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.clusters.yaml
new file mode 100644
index 000000000..382c2857a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-complex-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-complex-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.endpoints.yaml
new file mode 100644
index 000000000..f1cd2f6a2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.endpoints.yaml
@@ -0,0 +1,18 @@
+- clusterName: tcp-route-complex-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-complex-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.listeners.yaml
new file mode 100644
index 000000000..0c343d46e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.listeners.yaml
@@ -0,0 +1,23 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+      - bar.com
+      - example.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-complex-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: tcp-route-complex
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.clusters.yaml
new file mode 100644
index 000000000..c845c6403
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.endpoints.yaml
new file mode 100644
index 000000000..7eb06a08f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.endpoints.yaml
@@ -0,0 +1,18 @@
+- clusterName: tcp-route-simple-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.listeners.yaml
new file mode 100644
index 000000000..7fb5696df
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.listeners.yaml
@@ -0,0 +1,14 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-dest
+        statPrefix: tcp
+  name: tcp-route-simple
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.clusters.yaml
new file mode 100644
index 000000000..af4d15a65
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tls-terminate-dest
+  lbPolicy: LEAST_REQUEST
+  name: tls-terminate-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.endpoints.yaml
new file mode 100644
index 000000000..164abc9de
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.endpoints.yaml
@@ -0,0 +1,18 @@
+- clusterName: tls-terminate-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tls-terminate-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.listeners.yaml
new file mode 100644
index 000000000..34bc646e4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.listeners.yaml
@@ -0,0 +1,27 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tls-terminate-dest
+        statPrefix: terminate
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: envoy-gateway-tls-secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: tls-terminate
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.clusters.yaml
new file mode 100644
index 000000000..849359c13
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-weighted-backend-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-weighted-backend-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.endpoints.yaml
new file mode 100644
index 000000000..73db3a800
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.endpoints.yaml
@@ -0,0 +1,42 @@
+- clusterName: tcp-route-weighted-backend-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.1.1.1
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: tcp-route-weighted-backend-dest/backend/0
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 2.2.2.2
+            portValue: 50002
+      loadBalancingWeight: 1
+    loadBalancingWeight: 40
+    locality:
+      region: tcp-route-weighted-backend-dest/backend/1
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 3.3.3.3
+            portValue: 50003
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: tcp-route-weighted-backend-dest/backend/2
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 4.4.4.4
+            portValue: 50004
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: tcp-route-weighted-backend-dest/backend/3
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.listeners.yaml
new file mode 100644
index 000000000..74cd0effc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.listeners.yaml
@@ -0,0 +1,23 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+      - bar.com
+      - example.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-weighted-backend-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: tcp-route-weighted-backend
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.clusters.yaml
new file mode 100644
index 000000000..e2156cb6a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.clusters.yaml
@@ -0,0 +1,25 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 31s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      commonHttpProtocolOptions:
+        idleTimeout: 32s
+        maxConnectionDuration: 33s
+      explicitHttpConfig:
+        httpProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.clusters.yaml
new file mode 100644
index 000000000..f60942991
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.clusters.yaml
@@ -0,0 +1,44 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tls-passthrough-foo-dest
+  lbPolicy: LEAST_REQUEST
+  name: tls-passthrough-foo-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: tls-passthrough-bar-dest
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: bar
+              portValue: 50000
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: tls-passthrough-bar-dest/backend/0
+  name: tls-passthrough-bar-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.endpoints.yaml
new file mode 100644
index 000000000..ee66753c4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.endpoints.yaml
@@ -0,0 +1,18 @@
+- clusterName: tls-passthrough-foo-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tls-passthrough-foo-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.listeners.yaml
new file mode 100644
index 000000000..a1c312fa0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.listeners.yaml
@@ -0,0 +1,42 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tls-passthrough-foo-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: tls-passthrough-foo
+  perConnectionBufferLimitBytes: 32768
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10081
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - bar.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tls-passthrough-bar-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: tls-passthrough-bar
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml
new file mode 100644
index 000000000..36bc8d1ec
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml
@@ -0,0 +1,77 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - some-other-protocol
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          tlsParams:
+            cipherSuites:
+            - ECDHE-ECDSA-AES128-GCM-SHA256
+            - ECDHE-RSA-AES128-GCM-SHA256
+            - ECDHE-ECDSA-AES256-GCM-SHA384
+            - ECDHE-RSA-AES256-GCM-SHA384
+            ecdhCurves:
+            - X25519
+            - P-256
+            signatureAlgorithms:
+            - ecdsa_secp256r1_sha256
+            - rsa_pss_rsae_sha256
+            - rsa_pkcs1_sha256
+            - ecdsa_secp384r1_sha384
+            - rsa_pss_rsae_sha384
+            - rsa_pkcs1_sha384
+            - rsa_pss_rsae_sha512
+            - rsa_pkcs1_sha512
+            - rsa_pkcs1_sha1
+            tlsMaximumProtocolVersion: TLSv1_2
+            tlsMinimumProtocolVersion: TLSv1_0
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.clusters.yaml
new file mode 100644
index 000000000..eea2936ce
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.clusters.yaml
@@ -0,0 +1,49 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: direct-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: direct-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: tracing|otel-collector.monitoring.svc.cluster.local|4317
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: otel-collector.monitoring.svc.cluster.local
+              portValue: 4317
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: tracing|otel-collector.monitoring.svc.cluster.local|4317/backend/0
+  name: tracing|otel-collector.monitoring.svc.cluster.local|4317
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.endpoints.yaml
new file mode 100644
index 000000000..20c80b3aa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: direct-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: direct-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.listeners.yaml
new file mode 100644
index 000000000..d4737ef1f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.listeners.yaml
@@ -0,0 +1,62 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        tracing:
+          clientSampling:
+            value: 100
+          customTags:
+          - environment:
+              defaultValue: '-'
+              name: env1
+            tag: env1
+          - literal:
+              value: value1
+            tag: literal1
+          - requestHeader:
+              defaultValue: '-'
+              name: X-Request-Id
+            tag: req1
+          overallSampling:
+            value: 100
+          provider:
+            name: envoy.tracers.opentelemetry
+            typedConfig:
+              '@type': type.googleapis.com/envoy.config.trace.v3.OpenTelemetryConfig
+              grpcService:
+                envoyGrpc:
+                  authority: otel-collector.monitoring.svc.cluster.local
+                  clusterName: tracing|otel-collector.monitoring.svc.cluster.local|4317
+              serviceName: fake-name.fake-ns
+          randomSampling:
+            value: 90
+          spawnUpstreamSpan: true
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.routes.yaml
new file mode 100644
index 000000000..d4a7fa5ae
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - directResponse:
+        body:
+          inlineString: 'Unknown custom filter type: UnsupportedType'
+        status: 500
+      match:
+        prefix: /
+      name: direct-route
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.clusters.yaml
new file mode 100644
index 000000000..0656b7c45
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: udp-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: udp-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.endpoints.yaml
new file mode 100644
index 000000000..2e3c84e67
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.endpoints.yaml
@@ -0,0 +1,18 @@
+- clusterName: udp-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: udp-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.listeners.yaml
new file mode 100644
index 000000000..317a7ddc4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.listeners.yaml
@@ -0,0 +1,18 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+      protocol: UDP
+  listenerFilters:
+  - name: envoy.filters.udp_listener.udp_proxy
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig
+      matcher:
+        onNoMatch:
+          action:
+            name: route
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.Route
+              cluster: udp-route-dest
+      statPrefix: service
+  name: udp-route
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.clusters.yaml
new file mode 100644
index 000000000..6d5dffadf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.clusters.yaml
@@ -0,0 +1,22 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  upstreamConnectionOptions:
+    tcpKeepalive:
+      keepaliveInterval: 60
+      keepaliveProbes: 3
+      keepaliveTime: 1200
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/tracing.go b/adapter/internal/operator/gateway-api/translator/tracing.go
new file mode 100644
index 000000000..d4ff5b6bd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/tracing.go
@@ -0,0 +1,160 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	tracecfg "github.com/envoyproxy/go-control-plane/envoy/config/trace/v3"
+	hcm "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	tracingtype "github.com/envoyproxy/go-control-plane/envoy/type/tracing/v3"
+	xdstype "github.com/envoyproxy/go-control-plane/envoy/type/v3"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+	"k8s.io/utils/ptr"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	"github.com/wso2/apk/adapter/internal/types"
+	"github.com/wso2/apk/adapter/pkg/utils/protocov"
+)
+
+func buildHCMTracing(tracing *ir.Tracing) (*hcm.HttpConnectionManager_Tracing, error) {
+	if tracing == nil {
+		return nil, nil
+	}
+
+	oc := &tracecfg.OpenTelemetryConfig{
+		GrpcService: &corev3.GrpcService{
+			TargetSpecifier: &corev3.GrpcService_EnvoyGrpc_{
+				EnvoyGrpc: &corev3.GrpcService_EnvoyGrpc{
+					ClusterName: buildClusterName("tracing", tracing.Provider.Host, uint32(tracing.Provider.Port)),
+					Authority:   tracing.Provider.Host,
+				},
+			},
+		},
+		ServiceName: tracing.ServiceName,
+	}
+
+	ocAny, err := protocov.ToAnyWithError(oc)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal OpenTelemetryConfig: %w", err)
+	}
+
+	tags := []*tracingtype.CustomTag{}
+	// TODO: consider add some default tags for better UX
+	for k, v := range tracing.CustomTags {
+		switch v.Type {
+		case egv1a1.CustomTagTypeLiteral:
+			tags = append(tags, &tracingtype.CustomTag{
+				Tag: k,
+				Type: &tracingtype.CustomTag_Literal_{
+					Literal: &tracingtype.CustomTag_Literal{
+						Value: v.Literal.Value,
+					},
+				},
+			})
+		case egv1a1.CustomTagTypeEnvironment:
+			defaultVal := ""
+			if v.Environment.DefaultValue != nil {
+				defaultVal = *v.Environment.DefaultValue
+			}
+
+			tags = append(tags, &tracingtype.CustomTag{
+				Tag: k,
+				Type: &tracingtype.CustomTag_Environment_{
+					Environment: &tracingtype.CustomTag_Environment{
+						Name:         v.Environment.Name,
+						DefaultValue: defaultVal,
+					},
+				},
+			})
+		case egv1a1.CustomTagTypeRequestHeader:
+			defaultVal := ""
+			if v.RequestHeader.DefaultValue != nil {
+				defaultVal = *v.RequestHeader.DefaultValue
+			}
+
+			tags = append(tags, &tracingtype.CustomTag{
+				Tag: k,
+				Type: &tracingtype.CustomTag_RequestHeader{
+					RequestHeader: &tracingtype.CustomTag_Header{
+						Name:         v.RequestHeader.Name,
+						DefaultValue: defaultVal,
+					},
+				},
+			})
+		default:
+			return nil, fmt.Errorf("unknown custom tag type: %s", v.Type)
+		}
+	}
+	// sort tags by tag name, make result consistent
+	sort.Slice(tags, func(i, j int) bool {
+		return tags[i].Tag < tags[j].Tag
+	})
+
+	return &hcm.HttpConnectionManager_Tracing{
+		ClientSampling: &xdstype.Percent{
+			Value: 100.0,
+		},
+		OverallSampling: &xdstype.Percent{
+			Value: 100.0,
+		},
+		RandomSampling: &xdstype.Percent{
+			Value: float64(*tracing.SamplingRate),
+		},
+		Provider: &tracecfg.Tracing_Http{
+			Name: "envoy.tracers.opentelemetry",
+			ConfigType: &tracecfg.Tracing_Http_TypedConfig{
+				TypedConfig: ocAny,
+			},
+		},
+		CustomTags:        tags,
+		SpawnUpstreamSpan: wrapperspb.Bool(true),
+	}, nil
+}
+
+func processClusterForTracing(tCtx *types.ResourceVersionTable, tracing *ir.Tracing) error {
+	if tracing == nil {
+		return nil
+	}
+
+	clusterName := buildClusterName("tracing", tracing.Provider.Host, uint32(tracing.Provider.Port))
+
+	ds := &ir.DestinationSetting{
+		Weight:    ptr.To[uint32](1),
+		Protocol:  ir.GRPC,
+		Endpoints: []*ir.DestinationEndpoint{ir.NewDestEndpoint(tracing.Provider.Host, uint32(tracing.Provider.Port))},
+	}
+	if err := addXdsCluster(tCtx, &xdsClusterArgs{
+		name:         clusterName,
+		settings:     []*ir.DestinationSetting{ds},
+		tSocket:      nil,
+		endpointType: EndpointTypeDNS,
+	}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+		return err
+	}
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/translator.go b/adapter/internal/operator/gateway-api/translator/translator.go
new file mode 100644
index 000000000..eae45eb50
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/translator.go
@@ -0,0 +1,744 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"github.com/wso2/apk/adapter/pkg/utils/protocov"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+)
+
+var (
+	ErrXdsClusterExists = errors.New("xds cluster exists")
+	ErrXdsSecretExists  = errors.New("xds secret exists")
+)
+
+const AuthorityHeaderKey = ":authority"
+
+// Translator translates the xDS IR into xDS resources.
+type Translator struct {
+	// GlobalRateLimit holds the global rate limit settings
+	// required during xds translation.
+	GlobalRateLimit *GlobalRateLimitSettings
+
+	// ExtensionManager holds the config for interacting with extensions when generating xDS
+	// resources. Only required during xds translation.
+	// ExtensionManager *extensionTypes.Manager
+}
+
+type GlobalRateLimitSettings struct {
+	// ServiceURL is the URL of the global
+	// rate limit service.
+	ServiceURL string
+
+	// Timeout specifies the timeout period for the proxy to access the ratelimit server
+	// If not set, timeout is 20000000(20ms).
+	Timeout time.Duration
+
+	// FailClosed is a switch used to control the flow of traffic
+	// when the response from the ratelimit server cannot be obtained.
+	FailClosed bool
+}
+
+// Translate translates the XDS IR into xDS resources
+func (t *Translator) Translate(ir *ir.Xds) (*types.ResourceVersionTable, error) {
+	if ir == nil {
+		return nil, errors.New("ir is nil")
+	}
+
+	tCtx := new(types.ResourceVersionTable)
+
+	// xDS translation is done in a best-effort manner, so we collect all errors
+	// and return them at the end.
+	//
+	// Reasoning: The validation in the CRD validation and API Gateway API
+	// translator should already catch most errors, there are just few rare cases
+	// where xDS translation can fail, for example, failed to call an extension
+	// hook or failed to patch an EnvoyPatchPolicy. In those cases, we don't want
+	// to fail the entire xDS translation to panic users, but instead, we want
+	// to collect all errors and reflect them in the status of the CRDs.
+	var errs error
+	if err := t.processHTTPListenerXdsTranslation(
+		tCtx, ir.HTTP, ir.AccessLog, ir.Tracing, ir.Metrics); err != nil {
+		errs = errors.Join(errs, err)
+	}
+
+	if err := processTCPListenerXdsTranslation(tCtx, ir.TCP, ir.AccessLog); err != nil {
+		errs = errors.Join(errs, err)
+	}
+
+	if err := processUDPListenerXdsTranslation(tCtx, ir.UDP, ir.AccessLog); err != nil {
+		errs = errors.Join(errs, err)
+	}
+
+	if err := processClusterForAccessLog(tCtx, ir.AccessLog); err != nil {
+		errs = errors.Join(errs, err)
+	}
+	if err := processClusterForTracing(tCtx, ir.Tracing); err != nil {
+		errs = errors.Join(errs, err)
+	}
+
+	// Check if an extension want to inject any clusters/secrets
+	// If no extension exists (or it doesn't subscribe to this hook) then this is a quick no-op
+	// if err := processExtensionPostTranslationHook(tCtx, t.ExtensionManager); err != nil {
+	// 	errs = errors.Join(errs, err)
+	// }
+
+	return tCtx, errs
+}
+
+func (t *Translator) processHTTPListenerXdsTranslation(
+	tCtx *types.ResourceVersionTable,
+	httpListeners []*ir.HTTPListener,
+	accessLog *ir.AccessLog,
+	tracing *ir.Tracing,
+	metrics *ir.Metrics,
+) error {
+	// The XDS translation is done in a best-effort manner, so we collect all
+	// errors and return them at the end.
+	var errs error
+	for _, httpListener := range httpListeners {
+		addFilterChain := true
+		var xdsRouteCfg *routev3.RouteConfiguration
+
+		// Search for an existing listener, if it does not exist, create one.
+		xdsListener := findXdsListenerByHostPort(tCtx, httpListener.Address, httpListener.Port, corev3.SocketAddress_TCP)
+		var quicXDSListener *listenerv3.Listener
+		enabledHTTP3 := httpListener.HTTP3 != nil
+		if xdsListener == nil {
+			xdsListener = buildXdsTCPListener(httpListener.Name, httpListener.Address, httpListener.Port, httpListener.TCPKeepalive, accessLog)
+			if enabledHTTP3 {
+				quicXDSListener = buildXdsQuicListener(httpListener.Name, httpListener.Address, httpListener.Port, accessLog)
+				if err := tCtx.AddXdsResource(resourcev3.ListenerType, quicXDSListener); err != nil {
+					return err
+				}
+			}
+			if err := tCtx.AddXdsResource(resourcev3.ListenerType, xdsListener); err != nil {
+				// skip this listener if failed to add xds listener to the
+				// resource version table. Normally, this should not happen.
+				errs = errors.Join(errs, err)
+				continue
+			}
+		} else if httpListener.TLS == nil {
+			// Find the route config associated with this listener that
+			// maps to the default filter chain for http traffic
+			routeName := findXdsHTTPRouteConfigName(xdsListener)
+			if routeName != "" {
+				// If an existing listener exists, dont create a new filter chain
+				// for HTTP traffic, match on the Domains field within VirtualHosts
+				// within the same RouteConfiguration instead
+				addFilterChain = false
+				xdsRouteCfg = findXdsRouteConfig(tCtx, routeName)
+				if xdsRouteCfg == nil {
+					// skip this listener if failed to find xds route config
+					errs = errors.Join(errs, errors.New("unable to find xds route config"))
+					continue
+				}
+			}
+		}
+
+		if addFilterChain {
+			if err := t.addXdsHTTPFilterChain(xdsListener, httpListener, accessLog, tracing, false); err != nil {
+				return err
+			}
+			if enabledHTTP3 {
+				if err := t.addXdsHTTPFilterChain(quicXDSListener, httpListener, accessLog, tracing, true); err != nil {
+					return err
+				}
+			}
+		} else {
+			// When the DefaultFilterChain is shared by multiple Gateway HTTP
+			// Listeners, we need to add the HTTP filters associated with the
+			// HTTPListener to the HCM if they have not yet been added.
+			if err := t.addHTTPFiltersToHCM(xdsListener.DefaultFilterChain, httpListener); err != nil {
+				errs = errors.Join(errs, err)
+				continue
+			}
+			if enabledHTTP3 {
+				if err := t.addHTTPFiltersToHCM(quicXDSListener.DefaultFilterChain, httpListener); err != nil {
+					errs = errors.Join(errs, err)
+					continue
+				}
+			}
+		}
+
+		// Create a route config if we have not found one yet
+		if xdsRouteCfg == nil {
+			xdsRouteCfg = &routev3.RouteConfiguration{
+				IgnorePortInHostMatching: true,
+				Name:                     httpListener.Name,
+			}
+
+			if err := tCtx.AddXdsResource(resourcev3.RouteType, xdsRouteCfg); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+
+		// 1:1 between IR TLSListenerConfig and xDS Secret
+		if httpListener.TLS != nil {
+			for t := range httpListener.TLS.Certificates {
+				secret := buildXdsTLSCertSecret(httpListener.TLS.Certificates[t])
+				if err := tCtx.AddXdsResource(resourcev3.SecretType, secret); err != nil {
+					errs = errors.Join(errs, err)
+				}
+			}
+
+			if httpListener.TLS.CACertificate != nil {
+				caSecret := buildXdsTLSCaCertSecret(httpListener.TLS.CACertificate)
+				if err := tCtx.AddXdsResource(resourcev3.SecretType, caSecret); err != nil {
+					errs = errors.Join(errs, err)
+				}
+			}
+		}
+
+		// store virtual hosts by domain
+		vHosts := map[string]*routev3.VirtualHost{}
+		// keep track of order by using a list as well as the map
+		var vHostsList []*routev3.VirtualHost
+
+		// Check if an extension is loaded that wants to modify xDS Routes after they have been generated
+		for _, httpRoute := range httpListener.Routes {
+			// 1:1 between IR HTTPRoute Hostname and xDS VirtualHost.
+			vHost := vHosts[httpRoute.Hostname]
+			if vHost == nil {
+				// Remove dots from the hostname before appending it to the virtualHost name
+				// since dots are special chars used in stats tag extraction in Envoy
+				underscoredHostname := strings.ReplaceAll(httpRoute.Hostname, ".", "_")
+				// Allocate virtual host for this httpRoute.
+				vHost = &routev3.VirtualHost{
+					Name:    fmt.Sprintf("%s/%s", httpListener.Name, underscoredHostname),
+					Domains: []string{httpRoute.Hostname},
+				}
+				if metrics != nil && metrics.EnableVirtualHostStats {
+					vHost.VirtualClusters = []*routev3.VirtualCluster{
+						{
+							Name: underscoredHostname,
+							Headers: []*routev3.HeaderMatcher{
+								{
+									Name: AuthorityHeaderKey,
+									HeaderMatchSpecifier: &routev3.HeaderMatcher_StringMatch{
+										StringMatch: &matcherv3.StringMatcher{
+											MatchPattern: &matcherv3.StringMatcher_Prefix{
+												Prefix: httpRoute.Hostname,
+											},
+										},
+									},
+								},
+							},
+						},
+					}
+				}
+				vHosts[httpRoute.Hostname] = vHost
+				vHostsList = append(vHostsList, vHost)
+			}
+
+			// 1:1 between IR HTTPRoute and xDS config.route.v3.Route
+			xdsRoute, err := buildXdsRoute(httpRoute)
+			if err != nil {
+				// skip this route if failed to build xds route
+				errs = errors.Join(errs, err)
+				continue
+			}
+
+			// Check if an extension want to modify the route we just generated
+			// If no extension exists (or it doesn't subscribe to this hook) then this is a quick no-op.
+			// if err = processExtensionPostRouteHook(xdsRoute, vHost, httpRoute, t.ExtensionManager); err != nil {
+			// 	if err != nil {
+			// 		errs = errors.Join(errs, err)
+			// 	}
+			// }
+
+			if enabledHTTP3 {
+				http3AltSvcHeader := buildHTTP3AltSvcHeader(int(httpListener.HTTP3.QUICPort))
+				if xdsRoute.ResponseHeadersToAdd == nil {
+					xdsRoute.ResponseHeadersToAdd = make([]*corev3.HeaderValueOption, 0)
+				}
+				xdsRoute.ResponseHeadersToAdd = append(xdsRoute.ResponseHeadersToAdd, http3AltSvcHeader)
+			}
+			vHost.Routes = append(vHost.Routes, xdsRoute)
+
+			if httpRoute.Destination != nil {
+				if err = processXdsCluster(tCtx, httpRoute, httpListener.HTTP1); err != nil {
+					errs = errors.Join(errs, err)
+				}
+			}
+
+			if httpRoute.Mirrors != nil {
+				for _, mirrorDest := range httpRoute.Mirrors {
+					if err := addXdsCluster(tCtx, &xdsClusterArgs{
+						name:         mirrorDest.Name,
+						settings:     mirrorDest.Settings,
+						tSocket:      nil,
+						endpointType: EndpointTypeStatic,
+					}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+						errs = errors.Join(errs, err)
+					}
+				}
+			}
+		}
+
+		// for _, vHost := range vHostsList {
+		// 	// Check if an extension want to modify the Virtual Host we just generated
+		// 	// If no extension exists (or it doesn't subscribe to this hook) then this is a quick no-op.
+		// 	if err := processExtensionPostVHostHook(vHost, t.ExtensionManager); err != nil {
+		// 		errs = errors.Join(errs, err)
+		// 	}
+		// }
+		xdsRouteCfg.VirtualHosts = append(xdsRouteCfg.VirtualHosts, vHostsList...)
+
+		// Add all the other needed resources referenced by this filter to the
+		// resource version table.
+		if err := patchResources(tCtx, httpListener.Routes); err != nil {
+			return err
+		}
+
+		// RateLimit filter is handled separately because it relies on the global
+		// rate limit server configuration.
+		// Check if a ratelimit cluster exists, if not, add it, if it's needed.
+		// if err := t.createRateLimitServiceCluster(tCtx, httpListener); err != nil {
+		// 	errs = errors.Join(errs, err)
+		// }
+
+		// // Check if an extension want to modify the listener that was just configured/created
+		// // If no extension exists (or it doesn't subscribe to this hook) then this is a quick no-op
+		// if err := processExtensionPostListenerHook(tCtx, xdsListener, t.ExtensionManager); err != nil {
+		// 	errs = errors.Join(errs, err)
+		// }
+	}
+
+	return errs
+}
+
+func (t *Translator) addHTTPFiltersToHCM(filterChain *listenerv3.FilterChain, httpListener *ir.HTTPListener) error {
+	var (
+		hcm *hcmv3.HttpConnectionManager
+		err error
+	)
+
+	if hcm, err = findHCMinFilterChain(filterChain); err != nil {
+		return err // should not happen
+	}
+
+	// Add http filters to the HCM if they have not yet been added.
+	if err = t.patchHCMWithFilters(hcm, httpListener); err != nil {
+		return err
+	}
+
+	for i, filter := range filterChain.Filters {
+		if filter.Name == wellknown.HTTPConnectionManager {
+			var mgrAny *anypb.Any
+			if mgrAny, err = protocov.ToAnyWithError(hcm); err != nil {
+				return err
+			}
+
+			filterChain.Filters[i] = &listenerv3.Filter{
+				Name: wellknown.HTTPConnectionManager,
+				ConfigType: &listenerv3.Filter_TypedConfig{
+					TypedConfig: mgrAny,
+				},
+			}
+		}
+	}
+	return nil
+}
+
+func findHCMinFilterChain(filterChain *listenerv3.FilterChain) (*hcmv3.HttpConnectionManager, error) {
+	for _, filter := range filterChain.Filters {
+		if filter.Name == wellknown.HTTPConnectionManager {
+			hcm := &hcmv3.HttpConnectionManager{}
+			if err := anypb.UnmarshalTo(filter.GetTypedConfig(), hcm, proto.UnmarshalOptions{}); err != nil {
+				return nil, err
+			}
+			return hcm, nil
+		}
+	}
+	return nil, errors.New("http connection manager not found")
+}
+
+func buildHTTP3AltSvcHeader(port int) *corev3.HeaderValueOption {
+	return &corev3.HeaderValueOption{
+		Append: &wrapperspb.BoolValue{Value: true},
+		Header: &corev3.HeaderValue{
+			Key:   "alt-svc",
+			Value: strings.Join([]string{fmt.Sprintf(`%s=":%d"; ma=86400`, "h3", port)}, ", "),
+		},
+	}
+}
+
+func processTCPListenerXdsTranslation(tCtx *types.ResourceVersionTable, tcpListeners []*ir.TCPListener, accesslog *ir.AccessLog) error {
+	// The XDS translation is done in a best-effort manner, so we collect all
+	// errors and return them at the end.
+	var errs error
+	for _, tcpListener := range tcpListeners {
+		// Search for an existing listener, if it does not exist, create one.
+		xdsListener := findXdsListenerByHostPort(tCtx, tcpListener.Address, tcpListener.Port, corev3.SocketAddress_TCP)
+		if xdsListener == nil {
+			xdsListener = buildXdsTCPListener(tcpListener.Name, tcpListener.Address, tcpListener.Port, tcpListener.TCPKeepalive, accesslog)
+			if err := tCtx.AddXdsResource(resourcev3.ListenerType, xdsListener); err != nil {
+				// skip this listener if failed to add xds listener to the
+				errs = errors.Join(errs, err)
+				continue
+			}
+		}
+
+		if err := addXdsTCPFilterChain(xdsListener, tcpListener, tcpListener.Destination.Name, accesslog); err != nil {
+			errs = errors.Join(errs, err)
+		}
+
+		// 1:1 between IR TCPListener and xDS Cluster
+		if err := addXdsCluster(tCtx, &xdsClusterArgs{
+			name:         tcpListener.Destination.Name,
+			settings:     tcpListener.Destination.Settings,
+			tSocket:      nil,
+			endpointType: buildEndpointType(tcpListener.Destination.Settings),
+		}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+			errs = errors.Join(errs, err)
+		}
+
+		if tcpListener.TLS != nil && tcpListener.TLS.Terminate != nil {
+			for _, s := range tcpListener.TLS.Terminate.Certificates {
+				secret := buildXdsTLSCertSecret(s)
+				if err := tCtx.AddXdsResource(resourcev3.SecretType, secret); err != nil {
+					errs = errors.Join(errs, err)
+				}
+			}
+			if tcpListener.TLS.Terminate.CACertificate != nil {
+				caSecret := buildXdsTLSCaCertSecret(tcpListener.TLS.Terminate.CACertificate)
+				if err := tCtx.AddXdsResource(resourcev3.SecretType, caSecret); err != nil {
+					errs = errors.Join(errs, err)
+				}
+			}
+		}
+	}
+	return errs
+}
+
+func processUDPListenerXdsTranslation(tCtx *types.ResourceVersionTable, udpListeners []*ir.UDPListener, accesslog *ir.AccessLog) error {
+	// The XDS translation is done in a best-effort manner, so we collect all
+	// errors and return them at the end.
+	var errs error
+
+	for _, udpListener := range udpListeners {
+		// There won't be multiple UDP listeners on the same port since it's already been checked at the gateway api
+		// translator
+		xdsListener, err := buildXdsUDPListener(udpListener.Destination.Name, udpListener, accesslog)
+		if err != nil {
+			// skip this listener if failed to build xds listener
+			errs = errors.Join(errs, err)
+			continue
+		}
+		if err := tCtx.AddXdsResource(resourcev3.ListenerType, xdsListener); err != nil {
+			// skip this listener if failed to add xds listener to the resource version table
+			errs = errors.Join(errs, err)
+			continue
+		}
+
+		// 1:1 between IR UDPListener and xDS Cluster
+		if err := addXdsCluster(tCtx, &xdsClusterArgs{
+			name:         udpListener.Destination.Name,
+			settings:     udpListener.Destination.Settings,
+			tSocket:      nil,
+			endpointType: buildEndpointType(udpListener.Destination.Settings),
+		}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+// findXdsListenerByHostPort finds a xds listener with the same address, port and protocol, and returns nil if there is no match.
+func findXdsListenerByHostPort(tCtx *types.ResourceVersionTable, address string, port uint32,
+	protocol corev3.SocketAddress_Protocol) *listenerv3.Listener {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.ListenerType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.ListenerType] {
+		listener := r.(*listenerv3.Listener)
+		addr := listener.GetAddress()
+		if addr.GetSocketAddress().GetPortValue() == port && addr.GetSocketAddress().Address == address && addr.
+			GetSocketAddress().Protocol == protocol {
+			return listener
+		}
+	}
+
+	return nil
+}
+
+// findXdsListener finds a xds listener with the same name and returns nil if there is no match.
+func findXdsListener(tCtx *types.ResourceVersionTable, name string) *listenerv3.Listener {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.ListenerType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.ListenerType] {
+		listener := r.(*listenerv3.Listener)
+		if listener.Name == name {
+			return listener
+		}
+	}
+
+	return nil
+}
+
+// findXdsRouteConfig finds a xds route with the name and returns nil if there is no match.
+func findXdsRouteConfig(tCtx *types.ResourceVersionTable, name string) *routev3.RouteConfiguration {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.RouteType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.RouteType] {
+		route := r.(*routev3.RouteConfiguration)
+		if route.Name == name {
+			return route
+		}
+	}
+
+	return nil
+}
+
+// findXdsCluster finds a xds cluster with the same name, and returns nil if there is no match.
+func findXdsCluster(tCtx *types.ResourceVersionTable, name string) *clusterv3.Cluster {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.ClusterType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.ClusterType] {
+		cluster := r.(*clusterv3.Cluster)
+		if cluster.Name == name {
+			return cluster
+		}
+	}
+
+	return nil
+}
+
+// findXdsEndpoint finds a xds endpoint with the same cluster name, and returns nil if there is no match.
+func findXdsEndpoint(tCtx *types.ResourceVersionTable, name string) *endpointv3.ClusterLoadAssignment {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.EndpointType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.EndpointType] {
+		endpoint := r.(*endpointv3.ClusterLoadAssignment)
+		if endpoint.ClusterName == name {
+			return endpoint
+		}
+	}
+
+	return nil
+}
+
+// processXdsCluster processes a xds cluster by its endpoint address type.
+func processXdsCluster(tCtx *types.ResourceVersionTable, httpRoute *ir.HTTPRoute, http1Settings *ir.HTTP1Settings) error {
+	if err := addXdsCluster(tCtx, &xdsClusterArgs{
+		name:           httpRoute.Destination.Name,
+		settings:       httpRoute.Destination.Settings,
+		tSocket:        nil,
+		endpointType:   buildEndpointType(httpRoute.Destination.Settings),
+		loadBalancer:   httpRoute.LoadBalancer,
+		proxyProtocol:  httpRoute.ProxyProtocol,
+		circuitBreaker: httpRoute.CircuitBreaker,
+		healthCheck:    httpRoute.HealthCheck,
+		http1Settings:  http1Settings,
+		timeout:        httpRoute.Timeout,
+		tcpkeepalive:   httpRoute.TCPKeepalive,
+	}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+		return err
+	}
+
+	return nil
+}
+
+// processTLSSocket generates a xDS TransportSocket for a given TLS config.
+// It also adds the necessary secrets to the resource version table.
+func processTLSSocket(tlsConfig *ir.TLSUpstreamConfig, tCtx *types.ResourceVersionTable) (*corev3.TransportSocket, error) {
+	if tlsConfig == nil {
+		return nil, nil
+	}
+	// Create a secret for the CA certificate only if it's not using the system trust store
+	if !tlsConfig.UseSystemTrustStore {
+		CaSecret := buildXdsUpstreamTLSCASecret(tlsConfig)
+		if err := tCtx.AddXdsResource(resourcev3.SecretType, CaSecret); err != nil {
+			return nil, err
+		}
+	}
+
+	// for upstreamTLS , a fixed sni can be used. use auto_sni otherwise
+	// https://www.envoyproxy.io/docs/envoy/latest/faq/configuration/sni#faq-how-to-setup-sni:~:text=For%20clusters%2C%20a,for%20trust%20anchor.
+	tlsSocket, err := buildXdsUpstreamTLSSocketWthCert(tlsConfig)
+	if err != nil {
+		return nil, err
+	}
+	return tlsSocket, nil
+}
+
+// findXdsSecret finds a xds secret with the same name, and returns nil if there is no match.
+func findXdsSecret(tCtx *types.ResourceVersionTable, name string) *tlsv3.Secret {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.SecretType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.SecretType] {
+		secret := r.(*tlsv3.Secret)
+		if secret.Name == name {
+			return secret
+		}
+	}
+
+	return nil
+}
+
+func addXdsSecret(tCtx *types.ResourceVersionTable, secret *tlsv3.Secret) error {
+	// Return early if cluster with the same name exists
+	if c := findXdsSecret(tCtx, secret.Name); c != nil {
+		return ErrXdsSecretExists
+	}
+
+	return tCtx.AddXdsResource(resourcev3.SecretType, secret)
+}
+
+func addXdsCluster(tCtx *types.ResourceVersionTable, args *xdsClusterArgs) error {
+	// Return early if cluster with the same name exists
+	if c := findXdsCluster(tCtx, args.name); c != nil {
+		return ErrXdsClusterExists
+	}
+
+	xdsCluster := buildXdsCluster(args)
+	xdsEndpoints := buildXdsClusterLoadAssignment(args.name, args.settings)
+	for _, ds := range args.settings {
+		if ds.TLS != nil {
+			// Create a secret for the CA certificate only if it's not using the system trust store
+			if !ds.TLS.UseSystemTrustStore {
+				secret := buildXdsUpstreamTLSCASecret(ds.TLS)
+				if err := tCtx.AddXdsResource(resourcev3.SecretType, secret); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	// Use EDS for static endpoints
+	if args.endpointType == EndpointTypeStatic {
+		if err := tCtx.AddXdsResource(resourcev3.EndpointType, xdsEndpoints); err != nil {
+			return err
+		}
+	} else {
+		xdsCluster.LoadAssignment = xdsEndpoints
+	}
+	return tCtx.AddXdsResource(resourcev3.ClusterType, xdsCluster)
+}
+
+const (
+	DefaultEndpointType EndpointType = iota
+	Static
+	EDS
+)
+
+func buildXdsUpstreamTLSCASecret(tlsConfig *ir.TLSUpstreamConfig) *tlsv3.Secret {
+	// Build the tls secret
+	// It's just a sanity check, we shouldn't call this function if the system trust store is used
+	if tlsConfig.UseSystemTrustStore {
+		return nil
+	}
+	return &tlsv3.Secret{
+		Name: tlsConfig.CACertificate.Name,
+		Type: &tlsv3.Secret_ValidationContext{
+			ValidationContext: &tlsv3.CertificateValidationContext{
+				TrustedCa: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{InlineBytes: tlsConfig.CACertificate.Certificate},
+				},
+			},
+		},
+	}
+}
+
+func buildXdsUpstreamTLSSocketWthCert(tlsConfig *ir.TLSUpstreamConfig) (*corev3.TransportSocket, error) {
+
+	var tlsCtx *tlsv3.UpstreamTlsContext
+
+	if tlsConfig.UseSystemTrustStore {
+		tlsCtx = &tlsv3.UpstreamTlsContext{
+			CommonTlsContext: &tlsv3.CommonTlsContext{
+				ValidationContextType: &tlsv3.CommonTlsContext_ValidationContext{
+					ValidationContext: &tlsv3.CertificateValidationContext{
+						TrustedCa: &corev3.DataSource{
+							Specifier: &corev3.DataSource_Filename{
+								// This is the default location for the system trust store
+								// on Debian derivatives like the envoy-proxy image being used by the infrastructure
+								// controller.
+								// See https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl
+								// TODO: allow customizing this value via EnvoyGateway so that if a non-standard
+								// envoy image is being used, this can be modified to match
+								Filename: "/etc/ssl/certs/ca-certificates.crt",
+							},
+						},
+					},
+				},
+			},
+			Sni: tlsConfig.SNI,
+		}
+	} else {
+		tlsCtx = &tlsv3.UpstreamTlsContext{
+			CommonTlsContext: &tlsv3.CommonTlsContext{
+				TlsCertificateSdsSecretConfigs: nil,
+				ValidationContextType: &tlsv3.CommonTlsContext_ValidationContextSdsSecretConfig{
+					ValidationContextSdsSecretConfig: &tlsv3.SdsSecretConfig{
+						Name:      tlsConfig.CACertificate.Name,
+						SdsConfig: makeConfigSource(),
+					},
+				},
+			},
+			Sni: tlsConfig.SNI,
+		}
+	}
+
+	tlsCtxAny, err := anypb.New(tlsCtx)
+	if err != nil {
+		return nil, err
+	}
+
+	return &corev3.TransportSocket{
+		Name: wellknown.TransportSocketTLS,
+		ConfigType: &corev3.TransportSocket_TypedConfig{
+			TypedConfig: tlsCtxAny,
+		},
+	}, nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/translator_test.go b/adapter/internal/operator/gateway-api/translator/translator_test.go
new file mode 100644
index 000000000..2f47340b0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/translator_test.go
@@ -0,0 +1,556 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"embed"
+	"flag"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/envoyproxy/go-control-plane/pkg/cache/types"
+	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/stretchr/testify/require"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/utils"
+	"github.com/wso2/apk/adapter/pkg/utils/file"
+	"sigs.k8s.io/yaml"
+)
+
+var (
+	//go:embed testdata/out/*
+	outFiles embed.FS
+	//go:embed testdata/in/*
+	inFiles embed.FS
+
+	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
+)
+
+func TestTranslateXds(t *testing.T) {
+	testCases := []struct {
+		name                      string
+		dnsDomain                 string
+		requireSecrets            bool
+		requireEnvoyPatchPolicies bool
+	}{
+		{
+			name: "empty",
+		},
+		{
+			name: "http-route",
+		},
+		{
+			name: "http-route-regex",
+		},
+		{
+			name: "http-route-redirect",
+		},
+		{
+			name: "http-route-mirror",
+		},
+		{
+			name: "http-route-multiple-mirrors",
+		},
+		{
+			name: "http-route-multiple-matches",
+		},
+		{
+			name: "http-route-direct-response",
+		},
+		{
+			name: "http-route-request-headers",
+		},
+		{
+			name: "http-route-response-add-headers",
+		},
+		{
+			name: "http-route-response-remove-headers",
+		},
+		{
+			name: "http-route-response-add-remove-headers",
+		},
+		{
+			name: "http-route-weighted-invalid-backend",
+		},
+		{
+			name: "http-route-dns-cluster",
+		},
+		{
+			name:           "http-route-with-tls-system-truststore",
+			requireSecrets: true,
+		},
+		{
+			name:           "http-route-with-tlsbundle",
+			requireSecrets: true,
+		},
+		{
+			name:           "http-route-with-tlsbundle-multiple-certs",
+			requireSecrets: true,
+		},
+		{
+			name:           "simple-tls",
+			requireSecrets: true,
+		},
+		{
+			name:           "mutual-tls",
+			requireSecrets: true,
+		},
+		{
+			name:           "http3",
+			requireSecrets: true,
+		},
+		{
+			name: "tls-route-passthrough",
+		},
+		{
+			name: "tcp-route-simple",
+		},
+		{
+			name: "tcp-route-complex",
+		},
+		{
+			name: "tcp-route-tls-terminate",
+		},
+		{
+			name: "multiple-simple-tcp-route-same-port",
+		},
+		{
+			name: "http-route-weighted-backend",
+		},
+		{
+			name: "tcp-route-weighted-backend",
+		},
+		{
+			name:           "multiple-listeners-same-port",
+			requireSecrets: true,
+		},
+		{
+			name: "udp-route",
+		},
+		{
+			name: "http2-route",
+		},
+		{
+			name: "http-route-rewrite-url-prefix",
+		},
+		{
+			name: "http-route-rewrite-root-path-url-prefix",
+		},
+		{
+			name: "http-route-rewrite-url-fullpath",
+		},
+		{
+			name: "http-route-rewrite-url-host",
+		},
+		{
+			name: "http-route-timeout",
+		},
+		{
+			name: "accesslog",
+		},
+		{
+			name: "tracing",
+		},
+		{
+			name: "metrics-virtual-host",
+		},
+		{
+			name:                      "jsonpatch-missing-resource",
+			requireEnvoyPatchPolicies: true,
+		},
+		{
+			name:                      "jsonpatch-invalid-patch",
+			requireEnvoyPatchPolicies: true,
+		},
+		{
+			name:                      "jsonpatch-add-op-without-value",
+			requireEnvoyPatchPolicies: true,
+		},
+		{
+			name:                      "jsonpatch-move-op-with-value",
+			requireEnvoyPatchPolicies: true,
+		},
+		{
+			name: "listener-tcp-keepalive",
+		},
+		{
+			name: "load-balancer",
+		},
+		{
+			name: "cors",
+		},
+		{
+			name: "oidc",
+		},
+		{
+			name: "http-route-partial-invalid",
+		},
+		{
+			name: "listener-proxy-protocol",
+		},
+		{
+			name: "proxy-protocol-upstream",
+		},
+		{
+			name: "basic-auth",
+		},
+		{
+			name: "health-check",
+		},
+		{
+			name: "circuit-breaker",
+		},
+		{
+			name: "suppress-envoy-headers",
+		},
+		{
+			name: "fault-injection",
+		},
+		{
+			name: "tls-with-ciphers-versions-alpn",
+		},
+		{
+			name: "path-settings",
+		},
+		{
+			name: "http1-trailers",
+		},
+		{
+			name: "http1-preserve-case",
+		},
+		{
+			name: "timeout",
+		},
+		{
+			name: "ext-auth",
+		},
+		{
+			name: "http10",
+		},
+		{
+			name: "upstream-tcpkeepalive",
+		},
+		{
+			name: "client-timeout",
+		},
+		{
+			name: "retry-partial-invalid",
+		},
+		{
+			name: "multiple-listeners-same-port-with-different-filters",
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			dnsDomain := tc.dnsDomain
+			if dnsDomain == "" {
+				dnsDomain = "cluster.local"
+			}
+			ir := requireXdsIRFromInputTestData(t, "xds-ir", tc.name+".yaml")
+			tr := &Translator{
+				// GlobalRateLimit: &GlobalRateLimitSettings{
+				// 	ServiceURL: ratelimit.GetServiceURL("envoy-gateway-system", dnsDomain),
+				// },
+			}
+
+			tCtx, err := tr.Translate(ir)
+			if !strings.HasSuffix(tc.name, "partial-invalid") {
+				require.NoError(t, err)
+			}
+
+			listeners := tCtx.XdsResources[resourcev3.ListenerType]
+			routes := tCtx.XdsResources[resourcev3.RouteType]
+			clusters := tCtx.XdsResources[resourcev3.ClusterType]
+			endpoints := tCtx.XdsResources[resourcev3.EndpointType]
+			if *overrideTestData {
+				require.NoError(t, file.Write(requireResourcesToYAMLString(t, listeners), filepath.Join("testdata", "out", "xds-ir", tc.name+".listeners.yaml")))
+				require.NoError(t, file.Write(requireResourcesToYAMLString(t, routes), filepath.Join("testdata", "out", "xds-ir", tc.name+".routes.yaml")))
+				require.NoError(t, file.Write(requireResourcesToYAMLString(t, clusters), filepath.Join("testdata", "out", "xds-ir", tc.name+".clusters.yaml")))
+				require.NoError(t, file.Write(requireResourcesToYAMLString(t, endpoints), filepath.Join("testdata", "out", "xds-ir", tc.name+".endpoints.yaml")))
+			}
+			require.Equal(t, requireTestDataOutFile(t, "xds-ir", tc.name+".listeners.yaml"), requireResourcesToYAMLString(t, listeners))
+			require.Equal(t, requireTestDataOutFile(t, "xds-ir", tc.name+".routes.yaml"), requireResourcesToYAMLString(t, routes))
+			require.Equal(t, requireTestDataOutFile(t, "xds-ir", tc.name+".clusters.yaml"), requireResourcesToYAMLString(t, clusters))
+			require.Equal(t, requireTestDataOutFile(t, "xds-ir", tc.name+".endpoints.yaml"), requireResourcesToYAMLString(t, endpoints))
+			if tc.requireSecrets {
+				secrets := tCtx.XdsResources[resourcev3.SecretType]
+				if *overrideTestData {
+					require.NoError(t, file.Write(requireResourcesToYAMLString(t, secrets), filepath.Join("testdata", "out", "xds-ir", tc.name+".secrets.yaml")))
+				}
+				require.Equal(t, requireTestDataOutFile(t, "xds-ir", tc.name+".secrets.yaml"), requireResourcesToYAMLString(t, secrets))
+			}
+		})
+	}
+}
+
+func TestTranslateXdsNegative(t *testing.T) {
+	testCases := []struct {
+		name           string
+		dnsDomain      string
+		requireSecrets bool
+	}{
+		{
+			name: "http-route-invalid",
+		},
+		{
+			name: "tcp-route-invalid",
+		},
+		{
+			name: "tcp-route-invalid-endpoint",
+		},
+		{
+			name: "udp-route-invalid",
+		},
+		{
+			name: "jsonpatch-invalid",
+		},
+		{
+			name: "accesslog-invalid",
+		},
+		{
+			name: "tracing-invalid",
+		},
+		{
+			name: "jsonpatch-invalid-listener",
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			dnsDomain := tc.dnsDomain
+			if dnsDomain == "" {
+				dnsDomain = "cluster.local"
+			}
+			ir := requireXdsIRFromInputTestData(t, "xds-ir", tc.name+".yaml")
+			tr := &Translator{
+				// GlobalRateLimit: &GlobalRateLimitSettings{
+				// 	ServiceURL: ratelimit.GetServiceURL("envoy-gateway-system", dnsDomain),
+				// },
+			}
+
+			_, err := tr.Translate(ir)
+			require.Error(t, err)
+			if tc.name != "jsonpatch-invalid" {
+				require.Contains(t, err.Error(), "validation failed for xds resource")
+			}
+		})
+	}
+}
+
+// func TestTranslateRateLimitConfig(t *testing.T) {
+// 	testCases := []struct {
+// 		name string
+// 	}{
+// 		{
+// 			name: "empty-header-matches",
+// 		},
+// 		{
+// 			name: "distinct-match",
+// 		},
+// 		{
+// 			name: "distinct-remote-address-match",
+// 		},
+// 		{
+// 			name: "value-match",
+// 		},
+// 		{
+// 			name: "multiple-matches",
+// 		},
+// 		{
+// 			name: "multiple-rules",
+// 		},
+// 		{
+// 			name: "multiple-routes",
+// 		},
+// 		{
+// 			name: "masked-remote-address-match",
+// 		},
+// 		{
+// 			name: "multiple-masked-remote-address-match-with-same-cidr",
+// 		},
+// 	}
+
+// 	for _, tc := range testCases {
+// 		tc := tc
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			in := requireXdsIRListenerFromInputTestData(t, "ratelimit-config", tc.name+".yaml")
+// 			out := BuildRateLimitServiceConfig(in)
+// 			if *overrideTestData {
+// 				require.NoError(t, file.Write(requireYamlRootToYAMLString(t, out), filepath.Join("testdata", "out", "ratelimit-config", tc.name+".yaml")))
+// 			}
+// 			require.Equal(t, requireTestDataOutFile(t, "ratelimit-config", tc.name+".yaml"), requireYamlRootToYAMLString(t, out))
+// 		})
+// 	}
+// }
+
+// func TestTranslateXdsWithExtension(t *testing.T) {
+// 	testCases := []struct {
+// 		name           string
+// 		requireSecrets bool
+// 		err            string
+// 	}{
+// 		// Require secrets for all the tests since the extension for testing always injects one
+// 		{
+// 			name:           "empty",
+// 			requireSecrets: true,
+// 			err:            "",
+// 		},
+// 		{
+// 			name:           "http-route",
+// 			requireSecrets: true,
+// 			err:            "",
+// 		},
+// 		{
+// 			name:           "http-route-extension-filter",
+// 			requireSecrets: true,
+// 			err:            "",
+// 		},
+// 		{
+// 			name:           "http-route-extension-route-error",
+// 			requireSecrets: true,
+// 			err:            "route hook resource error",
+// 		},
+// 		{
+// 			name:           "http-route-extension-virtualhost-error",
+// 			requireSecrets: true,
+// 			err:            "extension post xds virtual host hook error",
+// 		},
+// 		{
+// 			name:           "http-route-extension-listener-error",
+// 			requireSecrets: true,
+// 			err:            "extension post xds listener hook error",
+// 		},
+// 	}
+
+// 	for _, tc := range testCases {
+// 		tc := tc
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			// Testdata for the extension tests is similar to the ir test dat
+// 			// New directory is just to keep them separate and easy to understand
+// 			ir := requireXdsIRFromInputTestData(t, "extension-xds-ir", tc.name+".yaml")
+// 			tr := &Translator{
+// 				// GlobalRateLimit: &GlobalRateLimitSettings{
+// 				// 	ServiceURL: ratelimit.GetServiceURL("envoy-gateway-system", "cluster.local"),
+// 				// },
+// 			}
+// 			// ext := v1alpha1.ExtensionManager{
+// 			// 	Resources: []v1alpha1.GroupVersionKind{
+// 			// 		{
+// 			// 			Group:   "foo.example.io",
+// 			// 			Version: "v1alpha1",
+// 			// 			Kind:    "examplefilter",
+// 			// 		},
+// 			// 	},
+// 			// 	Hooks: &v1alpha1.ExtensionHooks{
+// 			// 		XDSTranslator: &v1alpha1.XDSTranslatorHooks{
+// 			// 			Post: []v1alpha1.XDSTranslatorHook{
+// 			// 				v1alpha1.XDSRoute,
+// 			// 				v1alpha1.XDSVirtualHost,
+// 			// 				v1alpha1.XDSHTTPListener,
+// 			// 				v1alpha1.XDSTranslation,
+// 			// 			},
+// 			// 		},
+// 			// 	},
+// 			// }
+// 			// extMgr := testutils.NewManager(ext)
+// 			// tr.ExtensionManager = &extMgr
+
+// 			tCtx, err := tr.Translate(ir)
+
+// 			if tc.err != "" {
+// 				require.EqualError(t, err, tc.err)
+// 			} else {
+// 				require.NoError(t, err)
+// 				listeners := tCtx.XdsResources[resourcev3.ListenerType]
+// 				routes := tCtx.XdsResources[resourcev3.RouteType]
+// 				clusters := tCtx.XdsResources[resourcev3.ClusterType]
+// 				endpoints := tCtx.XdsResources[resourcev3.EndpointType]
+// 				if *overrideTestData {
+// 					require.NoError(t, file.Write(requireResourcesToYAMLString(t, listeners), filepath.Join("testdata", "out", "extension-xds-ir", tc.name+".listeners.yaml")))
+// 					require.NoError(t, file.Write(requireResourcesToYAMLString(t, routes), filepath.Join("testdata", "out", "extension-xds-ir", tc.name+".routes.yaml")))
+// 					require.NoError(t, file.Write(requireResourcesToYAMLString(t, clusters), filepath.Join("testdata", "out", "extension-xds-ir", tc.name+".clusters.yaml")))
+// 					require.NoError(t, file.Write(requireResourcesToYAMLString(t, endpoints), filepath.Join("testdata", "out", "extension-xds-ir", tc.name+".endpoints.yaml")))
+// 				}
+// 				require.Equal(t, requireTestDataOutFile(t, "extension-xds-ir", tc.name+".listeners.yaml"), requireResourcesToYAMLString(t, listeners))
+// 				require.Equal(t, requireTestDataOutFile(t, "extension-xds-ir", tc.name+".routes.yaml"), requireResourcesToYAMLString(t, routes))
+// 				require.Equal(t, requireTestDataOutFile(t, "extension-xds-ir", tc.name+".clusters.yaml"), requireResourcesToYAMLString(t, clusters))
+// 				require.Equal(t, requireTestDataOutFile(t, "extension-xds-ir", tc.name+".endpoints.yaml"), requireResourcesToYAMLString(t, endpoints))
+// 				if tc.requireSecrets {
+// 					secrets := tCtx.XdsResources[resourcev3.SecretType]
+// 					if *overrideTestData {
+// 						require.NoError(t, file.Write(requireResourcesToYAMLString(t, secrets), filepath.Join("testdata", "out", "extension-xds-ir", tc.name+".secrets.yaml")))
+// 					}
+// 					require.Equal(t, requireTestDataOutFile(t, "extension-xds-ir", tc.name+".secrets.yaml"), requireResourcesToYAMLString(t, secrets))
+// 				}
+// 			}
+// 		})
+// 	}
+// }
+
+func requireXdsIRFromInputTestData(t *testing.T, name ...string) *ir.Xds {
+	t.Helper()
+	elems := append([]string{"testdata", "in"}, name...)
+	content, err := inFiles.ReadFile(filepath.Join(elems...))
+	require.NoError(t, err)
+	ir := &ir.Xds{}
+	err = yaml.Unmarshal(content, ir)
+	require.NoError(t, err)
+	return ir
+}
+
+func requireXdsIRListenerFromInputTestData(t *testing.T, name ...string) *ir.HTTPListener {
+	t.Helper()
+	elems := append([]string{"testdata", "in"}, name...)
+	content, err := inFiles.ReadFile(filepath.Join(elems...))
+	require.NoError(t, err)
+	listener := &ir.HTTPListener{}
+	err = yaml.Unmarshal(content, listener)
+	require.NoError(t, err)
+	return listener
+}
+
+func requireTestDataOutFile(t *testing.T, name ...string) string {
+	t.Helper()
+	elems := append([]string{"testdata", "out"}, name...)
+	content, err := outFiles.ReadFile(filepath.Join(elems...))
+	require.NoError(t, err)
+	return string(content)
+}
+
+// func requireYamlRootToYAMLString(t *testing.T, pbRoot *ratelimitv3.RateLimitConfig) string {
+// 	str, err := GetRateLimitServiceConfigStr(pbRoot)
+// 	require.NoError(t, err)
+// 	return str
+// }
+
+func requireResourcesToYAMLString(t *testing.T, resources []types.Resource) string {
+	jsonBytes, err := utils.MarshalResourcesToJSON(resources)
+	require.NoError(t, err)
+	data, err := yaml.JSONToYAML(jsonBytes)
+	require.NoError(t, err)
+	return string(data)
+}
diff --git a/adapter/internal/operator/gateway-api/translator/utils.go b/adapter/internal/operator/gateway-api/translator/utils.go
new file mode 100644
index 000000000..90f1d3882
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/utils.go
@@ -0,0 +1,135 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+	"net/url"
+	"strconv"
+	"strings"
+
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+const (
+	defaultHTTPSPort                uint64 = 443
+	defaultHTTPPort                 uint64 = 80
+	defaultExtServiceRequestTimeout        = 10 // 10 seconds
+)
+
+// urlCluster is a cluster that is created from a URL.
+type urlCluster struct {
+	name         string
+	hostname     string
+	port         uint32
+	endpointType EndpointType
+	tls          bool
+}
+
+// url2Cluster returns a urlCluster from the provided url.
+func url2Cluster(strURL string) (*urlCluster, error) {
+	epType := EndpointTypeDNS
+
+	// The URL should have already been validated in the gateway API translator.
+	u, err := url.Parse(strURL)
+	if err != nil {
+		return nil, err
+	}
+
+	var port uint64
+	if u.Scheme == "https" {
+		port = defaultHTTPSPort
+	} else {
+		port = defaultHTTPPort
+	}
+
+	if u.Port() != "" {
+		port, err = strconv.ParseUint(u.Port(), 10, 32)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	name := clusterName(u.Hostname(), uint32(port))
+
+	if ip, err := netip.ParseAddr(u.Hostname()); err == nil {
+		if ip.Unmap().Is4() {
+			epType = EndpointTypeStatic
+		}
+	}
+
+	return &urlCluster{
+		name:         name,
+		hostname:     u.Hostname(),
+		port:         uint32(port),
+		endpointType: epType,
+		tls:          u.Scheme == "https",
+	}, nil
+}
+
+func clusterName(host string, port uint32) string {
+	return fmt.Sprintf("%s_%d", strings.ReplaceAll(host, ".", "_"), port)
+}
+
+// enableFilterOnRoute enables a filterType on the provided route.
+func enableFilterOnRoute(filterType string, route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+
+	filterName := perRouteFilterName(filterType, irRoute.Name)
+	filterCfg := route.GetTypedPerFilterConfig()
+	if _, ok := filterCfg[filterName]; ok {
+		// This should not happen since this is the only place where the filter
+		// config is added in a route.
+		return fmt.Errorf("route already contains filter config: %s, %+v",
+			filterType, route)
+	}
+
+	// Enable the corresponding filter for this route.
+	routeCfgAny, err := anypb.New(&routev3.FilterConfig{
+		Config: &anypb.Any{},
+	})
+	if err != nil {
+		return err
+	}
+
+	if filterCfg == nil {
+		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
+	}
+
+	route.TypedPerFilterConfig[filterName] = routeCfgAny
+
+	return nil
+}
+
+func perRouteFilterName(filterType, routeName string) string {
+	return fmt.Sprintf("%s_%s", filterType, routeName)
+}
diff --git a/adapter/internal/operator/gateway-api/types/tls_types.go b/adapter/internal/operator/gateway-api/types/tls_types.go
new file mode 100644
index 000000000..cc891cab3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/types/tls_types.go
@@ -0,0 +1,145 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package types
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// +kubebuilder:validation:XValidation:rule="has(self.minVersion) && self.minVersion == '1.3' ? !has(self.ciphers) : true", message="setting ciphers has no effect if the minimum possible TLS version is 1.3"
+// +kubebuilder:validation:XValidation:rule="has(self.minVersion) && has(self.maxVersion) ? {\"Auto\":0,\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4}[self.minVersion] <= {\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4,\"Auto\":5}[self.maxVersion] : !has(self.minVersion) && has(self.maxVersion) ? 3 <= {\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4,\"Auto\":5}[self.maxVersion] : true", message="minVersion must be smaller or equal to maxVersion"
+type TLSSettings struct {
+
+	// Min specifies the minimal TLS protocol version to allow.
+	// The default is TLS 1.2 if this is not specified.
+	//
+	// +optional
+	MinVersion *TLSVersion `json:"minVersion,omitempty"`
+
+	// Max specifies the maximal TLS protocol version to allow
+	// The default is TLS 1.3 if this is not specified.
+	//
+	// +optional
+	MaxVersion *TLSVersion `json:"maxVersion,omitempty"`
+
+	// Ciphers specifies the set of cipher suites supported when
+	// negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
+	// In non-FIPS Envoy Proxy builds the default cipher list is:
+	// - [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
+	// - [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
+	// - ECDHE-ECDSA-AES256-GCM-SHA384
+	// - ECDHE-RSA-AES256-GCM-SHA384
+	// In builds using BoringSSL FIPS the default cipher list is:
+	// - ECDHE-ECDSA-AES128-GCM-SHA256
+	// - ECDHE-RSA-AES128-GCM-SHA256
+	// - ECDHE-ECDSA-AES256-GCM-SHA384
+	// - ECDHE-RSA-AES256-GCM-SHA384
+	//
+	// +optional
+	Ciphers []string `json:"ciphers,omitempty"`
+
+	// ECDHCurves specifies the set of supported ECDH curves.
+	// In non-FIPS Envoy Proxy builds the default curves are:
+	// - X25519
+	// - P-256
+	// In builds using BoringSSL FIPS the default curve is:
+	// - P-256
+	//
+	// +optional
+	ECDHCurves []string `json:"ecdhCurves,omitempty"`
+
+	// SignatureAlgorithms specifies which signature algorithms the listener should
+	// support.
+	//
+	// +optional
+	SignatureAlgorithms []string `json:"signatureAlgorithms,omitempty"`
+
+	// ALPNProtocols supplies the list of ALPN protocols that should be
+	// exposed by the listener. By default h2 and http/1.1 are enabled.
+	// Supported values are:
+	// - http/1.0
+	// - http/1.1
+	// - h2
+	//
+	// +optional
+	ALPNProtocols []ALPNProtocol `json:"alpnProtocols,omitempty"`
+
+	// ClientValidation specifies the configuration to validate the client
+	// initiating the TLS connection to the Gateway listener.
+	// +optional
+	ClientValidation *ClientValidationContext `json:"clientValidation,omitempty"`
+}
+
+// ALPNProtocol specifies the protocol to be negotiated using ALPN
+// +kubebuilder:validation:Enum=http/1.0;http/1.1;h2
+type ALPNProtocol string
+
+// When adding ALPN constants, they must be values that are defined
+// in the IANA registry for ALPN identification sequences
+// https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
+const (
+	// HTTPProtocolVersion1_0 specifies that HTTP/1.0 should be negotiable with ALPN
+	HTTPProtocolVersion1_0 ALPNProtocol = "http/1.0"
+	// HTTPProtocolVersion1_1 specifies that HTTP/1.1 should be negotiable with ALPN
+	HTTPProtocolVersion1_1 ALPNProtocol = "http/1.1"
+	// HTTPProtocolVersion2 specifies that HTTP/2 should be negotiable with ALPN
+	HTTPProtocolVersion2 ALPNProtocol = "h2"
+)
+
+// TLSVersion specifies the TLS version
+// +kubebuilder:validation:Enum=Auto;"1.0";"1.1";"1.2";"1.3"
+type TLSVersion string
+
+const (
+	// TLSAuto allows Envoy to choose the optimal TLS Version
+	TLSAuto TLSVersion = "Auto"
+	// TLS1.0 specifies TLS version 1.0
+	TLSv10 TLSVersion = "1.0"
+	// TLS1.1 specifies TLS version 1.1
+	TLSv11 TLSVersion = "1.1"
+	// TLSv1.2 specifies TLS version 1.2
+	TLSv12 TLSVersion = "1.2"
+	// TLSv1.3 specifies TLS version 1.3
+	TLSv13 TLSVersion = "1.3"
+)
+
+// ClientValidationContext holds configuration that can be used to validate the client initiating the TLS connection
+// to the Gateway.
+// By default, no client specific configuration is validated.
+type ClientValidationContext struct {
+	// CACertificateRefs contains one or more references to
+	// Kubernetes objects that contain TLS certificates of
+	// the Certificate Authorities that can be used
+	// as a trust anchor to validate the certificates presented by the client.
+	//
+	// A single reference to a Kubernetes ConfigMap or a Kubernetes Secret,
+	// with the CA certificate in a key named `ca.crt` is currently supported.
+	//
+	// References to a resource in different namespace are invalid UNLESS there
+	// is a ReferenceGrant in the target namespace that allows the certificate
+	// to be attached.
+	//
+	// +kubebuilder:validation:MaxItems=8
+	// +optional
+	CACertificateRefs []gwapiv1.SecretObjectReference `json:"caCertificateRefs,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/accesslogging_types.go b/adapter/internal/operator/gateway-api/v1alpha1/accesslogging_types.go
new file mode 100644
index 000000000..0e72150a5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/accesslogging_types.go
@@ -0,0 +1,136 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+// +k8s:deepcopy-gen=true
+type ProxyAccessLog struct {
+	// Disable disables access logging for managed proxies if set to true.
+	Disable bool `json:"disable,omitempty"`
+	// Settings defines accesslog settings for managed proxies.
+	// If unspecified, will send default format to stdout.
+	// +optional
+	Settings []ProxyAccessLogSetting `json:"settings,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyAccessLogSetting struct {
+	// Format defines the format of accesslog.
+	Format ProxyAccessLogFormat `json:"format"`
+	// Sinks defines the sinks of accesslog.
+	// +kubebuilder:validation:MinItems=1
+	Sinks []ProxyAccessLogSink `json:"sinks"`
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyAccessLogFormatType string
+
+const (
+	// ProxyAccessLogFormatTypeText defines the text accesslog format.
+	ProxyAccessLogFormatTypeText ProxyAccessLogFormatType = "Text"
+	// ProxyAccessLogFormatTypeJSON defines the JSON accesslog format.
+	ProxyAccessLogFormatTypeJSON ProxyAccessLogFormatType = "JSON"
+	// TODO: support format type "mix" in the future.
+)
+
+// +k8s:deepcopy-gen=true
+// ProxyAccessLogFormat defines the format of accesslog.
+// By default accesslogs are written to standard output.
+// +union
+//
+// +kubebuilder:validation:XValidation:rule="self.type == 'Text' ? has(self.text) : !has(self.text)",message="If AccessLogFormat type is Text, text field needs to be set."
+// +kubebuilder:validation:XValidation:rule="self.type == 'JSON' ? has(self.json) : !has(self.json)",message="If AccessLogFormat type is JSON, json field needs to be set."
+type ProxyAccessLogFormat struct {
+	// Type defines the type of accesslog format.
+	// +kubebuilder:validation:Enum=Text;JSON
+	// +unionDiscriminator
+	Type ProxyAccessLogFormatType `json:"type,omitempty"`
+	// Text defines the text accesslog format, following Envoy accesslog formatting,
+	// It's required when the format type is "Text".
+	// Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be used in the format.
+	// The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings) provides more information.
+	// +optional
+	Text *string `json:"text,omitempty"`
+	// JSON is additional attributes that describe the specific event occurrence.
+	// Structured format for the envoy access logs. Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators)
+	// can be used as values for fields within the Struct.
+	// It's required when the format type is "JSON".
+	// +optional
+	JSON map[string]string `json:"json,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyAccessLogSinkType string
+
+const (
+	// ProxyAccessLogSinkTypeFile defines the file accesslog sink.
+	ProxyAccessLogSinkTypeFile ProxyAccessLogSinkType = "File"
+	// ProxyAccessLogSinkTypeOpenTelemetry defines the OpenTelemetry accesslog sink.
+	// When the provider is Kubernetes, EnvoyGateway always sends `k8s.namespace.name`
+	// and `k8s.pod.name` as additional attributes.
+	ProxyAccessLogSinkTypeOpenTelemetry ProxyAccessLogSinkType = "OpenTelemetry"
+)
+
+// +k8s:deepcopy-gen=true
+// ProxyAccessLogSink defines the sink of accesslog.
+// +union
+//
+// +kubebuilder:validation:XValidation:rule="self.type == 'File' ? has(self.file) : !has(self.file)",message="If AccessLogSink type is File, file field needs to be set."
+// +kubebuilder:validation:XValidation:rule="self.type == 'OpenTelemetry' ? has(self.openTelemetry) : !has(self.openTelemetry)",message="If AccessLogSink type is OpenTelemetry, openTelemetry field needs to be set."
+type ProxyAccessLogSink struct {
+	// Type defines the type of accesslog sink.
+	// +kubebuilder:validation:Enum=File;OpenTelemetry
+	// +unionDiscriminator
+	Type ProxyAccessLogSinkType `json:"type,omitempty"`
+	// File defines the file accesslog sink.
+	// +optional
+	File *FileEnvoyProxyAccessLog `json:"file,omitempty"`
+	// OpenTelemetry defines the OpenTelemetry accesslog sink.
+	// +optional
+	OpenTelemetry *OpenTelemetryEnvoyProxyAccessLog `json:"openTelemetry,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type FileEnvoyProxyAccessLog struct {
+	// Path defines the file path used to expose envoy access log(e.g. /dev/stdout).
+	// +kubebuilder:validation:MinLength=1
+	Path string `json:"path,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// TODO: consider reuse ExtensionService?
+type OpenTelemetryEnvoyProxyAccessLog struct {
+	// Host define the extension service hostname.
+	Host string `json:"host"`
+	// Port defines the port the extension service is exposed on.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:default=4317
+	Port int32 `json:"port,omitempty"`
+	// Resources is a set of labels that describe the source of a log entry, including envoy node info.
+	// It's recommended to follow [semantic conventions](https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/).
+	// +optional
+	Resources map[string]string `json:"resources,omitempty"`
+
+	// TODO: support more OpenTelemetry accesslog options(e.g. TLS, auth etc.) in the future.
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go
new file mode 100644
index 000000000..666f39b99
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go
@@ -0,0 +1,150 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/utils/ptr"
+)
+
+// DefaultEnvoyProxyProvider returns a new EnvoyProxyProvider with default settings.
+func DefaultEnvoyProxyProvider() *EnvoyProxyProvider {
+	return &EnvoyProxyProvider{
+		Type: ProviderTypeKubernetes,
+	}
+}
+
+// GetEnvoyProxyProvider returns the EnvoyProxyProvider of EnvoyProxy or a default EnvoyProxyProvider
+// if unspecified.
+func (e *EnvoyProxy) GetEnvoyProxyProvider() *EnvoyProxyProvider {
+	if e.Spec.Provider != nil {
+		return e.Spec.Provider
+	}
+	e.Spec.Provider = DefaultEnvoyProxyProvider()
+
+	return e.Spec.Provider
+}
+
+// DefaultEnvoyProxyKubeProvider returns a new EnvoyProxyKubernetesProvider with default settings.
+func DefaultEnvoyProxyKubeProvider() *EnvoyProxyKubernetesProvider {
+	return &EnvoyProxyKubernetesProvider{
+		EnvoyDeployment: DefaultKubernetesDeployment(DefaultEnvoyProxyImage, DefaultEnforcerImage),
+		EnvoyService:    DefaultKubernetesService(),
+	}
+}
+
+func DefaultEnvoyProxyHpaMetrics() []autoscalingv2.MetricSpec {
+	return []autoscalingv2.MetricSpec{
+		{
+			Resource: &autoscalingv2.ResourceMetricSource{
+				Name: v1.ResourceCPU,
+				Target: autoscalingv2.MetricTarget{
+					Type:               autoscalingv2.UtilizationMetricType,
+					AverageUtilization: ptr.To[int32](80),
+				},
+			},
+			Type: autoscalingv2.ResourceMetricSourceType,
+		},
+	}
+}
+
+// GetEnvoyProxyKubeProvider returns the EnvoyProxyKubernetesProvider of EnvoyProxyProvider or
+// a default EnvoyProxyKubernetesProvider if unspecified. If EnvoyProxyProvider is not of
+// type "Kubernetes", a nil EnvoyProxyKubernetesProvider is returned.
+func (r *EnvoyProxyProvider) GetEnvoyProxyKubeProvider() *EnvoyProxyKubernetesProvider {
+	if r.Type != ProviderTypeKubernetes {
+		return nil
+	}
+
+	if r.Kubernetes == nil {
+		r.Kubernetes = DefaultEnvoyProxyKubeProvider()
+		return r.Kubernetes
+	}
+
+	if r.Kubernetes.EnvoyDeployment == nil {
+		r.Kubernetes.EnvoyDeployment = DefaultKubernetesDeployment(DefaultEnvoyProxyImage, DefaultEnforcerImage)
+	}
+
+	r.Kubernetes.EnvoyDeployment.defaultKubernetesDeploymentSpec(DefaultEnvoyProxyImage, DefaultEnforcerImage)
+
+	if r.Kubernetes.EnvoyService == nil {
+		r.Kubernetes.EnvoyService = DefaultKubernetesService()
+	}
+
+	if r.Kubernetes.EnvoyService.Type == nil {
+		r.Kubernetes.EnvoyService.Type = GetKubernetesServiceType(ServiceTypeLoadBalancer)
+	}
+
+	if r.Kubernetes.EnvoyHpa != nil {
+		r.Kubernetes.EnvoyHpa.setDefault()
+	}
+
+	return r.Kubernetes
+}
+
+// DefaultEnvoyProxyLoggingLevel returns envoy proxy  v1alpha1.LogComponentGatewayDefault log level.
+// If unspecified, defaults to "warn". When specified, all other logging components are ignored.
+func (logging *ProxyLogging) DefaultEnvoyProxyLoggingLevel() LogLevel {
+	if logging.Level[LogComponentDefault] != "" {
+		return logging.Level[LogComponentDefault]
+	}
+
+	return LogLevelWarn
+}
+
+// GetEnvoyProxyComponentLevel returns envoy proxy component log level args.
+// xref: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#cmdoption-component-log-level
+func (logging *ProxyLogging) GetEnvoyProxyComponentLevel() string {
+	var args []string
+
+	for component, level := range logging.Level {
+		if component == LogComponentDefault {
+			// Skip default component
+			continue
+		}
+
+		if level != "" {
+			args = append(args, fmt.Sprintf("%s:%s", component, level))
+		}
+	}
+
+	sort.Strings(args)
+
+	return strings.Join(args, ",")
+}
+
+// DefaultShutdownManagerContainerResourceRequirements returns a new ResourceRequirements with default settings.
+func DefaultShutdownManagerContainerResourceRequirements() *v1.ResourceRequirements {
+	return &v1.ResourceRequirements{
+		Requests: v1.ResourceList{
+			v1.ResourceCPU:    resource.MustParse(DefaultShutdownManagerCPUResourceRequests),
+			v1.ResourceMemory: resource.MustParse(DefaultShutdownManagerMemoryResourceRequests),
+		},
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_metric_types.go b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_metric_types.go
new file mode 100644
index 000000000..a448b782a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_metric_types.go
@@ -0,0 +1,88 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+type MetricSinkType string
+
+const (
+	MetricSinkTypeOpenTelemetry MetricSinkType = "OpenTelemetry"
+)
+
+// +k8s:deepcopy-gen=true
+type ProxyMetrics struct {
+	// Prometheus defines the configuration for Admin endpoint `/stats/prometheus`.
+	Prometheus *ProxyPrometheusProvider `json:"prometheus,omitempty"`
+	// Sinks defines the metric sinks where metrics are sent to.
+	Sinks []ProxyMetricSink `json:"sinks,omitempty"`
+	// Matches defines configuration for selecting specific metrics instead of generating all metrics stats
+	// that are enabled by default. This helps reduce CPU and memory overhead in Envoy, but eliminating some stats
+	// may after critical functionality. Here are the stats that we strongly recommend not disabling:
+	// `cluster_manager.warming_clusters`, `cluster.<cluster_name>.membership_total`,`cluster.<cluster_name>.membership_healthy`,
+	// `cluster.<cluster_name>.membership_degraded`，reference  https://github.com/envoyproxy/envoy/issues/9856,
+	// https://github.com/envoyproxy/envoy/issues/14610
+	//
+	Matches []StringMatch `json:"matches,omitempty"`
+
+	// EnableVirtualHostStats enables envoy stat metrics for virtual hosts.
+	EnableVirtualHostStats bool `json:"enableVirtualHostStats,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ProxyMetricSink defines the sink of metrics.
+// Default metrics sink is OpenTelemetry.
+// +union
+//
+// +kubebuilder:validation:XValidation:rule="self.type == 'OpenTelemetry' ? has(self.openTelemetry) : !has(self.openTelemetry)",message="If MetricSink type is OpenTelemetry, openTelemetry field needs to be set."
+type ProxyMetricSink struct {
+	// Type defines the metric sink type.
+	// EG currently only supports OpenTelemetry.
+	// +kubebuilder:validation:Enum=OpenTelemetry
+	// +kubebuilder:default=OpenTelemetry
+	// +unionDiscriminator
+	Type MetricSinkType `json:"type"`
+	// OpenTelemetry defines the configuration for OpenTelemetry sink.
+	// It's required if the sink type is OpenTelemetry.
+	// +optional
+	OpenTelemetry *ProxyOpenTelemetrySink `json:"openTelemetry,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyOpenTelemetrySink struct {
+	// Host define the service hostname.
+	Host string `json:"host"`
+	// Port defines the port the service is exposed on.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=65535
+	// +kubebuilder:default=4317
+	Port int32 `json:"port,omitempty"`
+
+	// TODO: add support for customizing OpenTelemetry sink in https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/stat_sinks/open_telemetry/v3/open_telemetry.proto#envoy-v3-api-msg-extensions-stat-sinks-open-telemetry-v3-sinkconfig
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyPrometheusProvider struct {
+	// Disable the Prometheus endpoint.
+	Disable bool `json:"disable,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go
new file mode 100644
index 000000000..b0b36db1a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go
@@ -0,0 +1,278 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	// KindEnvoyProxy is the name of the EnvoyProxy kind.
+	KindEnvoyProxy = "EnvoyProxy"
+)
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:categories=envoy-gateway,shortName=eproxy
+// +kubebuilder:subresource:status
+
+// EnvoyProxy is the schema for the envoyproxies API.
+type EnvoyProxy struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// EnvoyProxySpec defines the desired state of EnvoyProxy.
+	Spec EnvoyProxySpec `json:"spec,omitempty"`
+	// EnvoyProxyStatus defines the actual state of EnvoyProxy.
+	Status EnvoyProxyStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// EnvoyProxySpec defines the desired state of EnvoyProxy.
+type EnvoyProxySpec struct {
+	// Provider defines the desired resource provider and provider-specific configuration.
+	// If unspecified, the "Kubernetes" resource provider is used with default configuration
+	// parameters.
+	//
+	// +optional
+	Provider *EnvoyProxyProvider `json:"provider,omitempty"`
+
+	// Logging defines logging parameters for managed proxies.
+	// +kubebuilder:default={level: {default: warn}}
+	Logging ProxyLogging `json:"logging,omitempty"`
+
+	// Telemetry defines telemetry parameters for managed proxies.
+	//
+	// +optional
+	Telemetry *ProxyTelemetry `json:"telemetry,omitempty"`
+
+	// Bootstrap defines the Envoy Bootstrap as a YAML string.
+	// Visit https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-msg-config-bootstrap-v3-bootstrap
+	// to learn more about the syntax.
+	// If set, this is the Bootstrap configuration used for the managed Envoy Proxy fleet instead of the default Bootstrap configuration
+	// set by Envoy Gateway.
+	// Some fields within the Bootstrap that are required to communicate with the xDS Server (Envoy Gateway) and receive xDS resources
+	// from it are not configurable and will result in the `EnvoyProxy` resource being rejected.
+	// Backward compatibility across minor versions is not guaranteed.
+	// We strongly recommend using `egctl x translate` to generate a `EnvoyProxy` resource with the `Bootstrap` field set to the default
+	// Bootstrap configuration used. You can edit this configuration, and rerun `egctl x translate` to ensure there are no validation errors.
+	//
+	// +optional
+	Bootstrap *ProxyBootstrap `json:"bootstrap,omitempty"`
+
+	// Concurrency defines the number of worker threads to run. If unset, it defaults to
+	// the number of cpuset threads on the platform.
+	//
+	// +optional
+	Concurrency *int32 `json:"concurrency,omitempty"`
+
+	// ExtraArgs defines additional command line options that are provided to Envoy.
+	// More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options
+	// Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here.
+	//
+	// +optional
+	ExtraArgs []string `json:"extraArgs,omitempty"`
+
+	// MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.
+	// Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.
+	// This means that the port, protocol and hostname tuple must be unique for every listener.
+	// If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition.
+	//
+	// +optional
+	MergeGateways *bool `json:"mergeGateways,omitempty"`
+
+	// Shutdown defines configuration for graceful envoy shutdown process.
+	//
+	// +optional
+	Shutdown *ShutdownConfig `json:"shutdown,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyTelemetry struct {
+	// AccessLogs defines accesslog parameters for managed proxies.
+	// If unspecified, will send default format to stdout.
+	// +optional
+	AccessLog *ProxyAccessLog `json:"accessLog,omitempty"`
+	// Tracing defines tracing configuration for managed proxies.
+	// If unspecified, will not send tracing data.
+	// +optional
+	Tracing *ProxyTracing `json:"tracing,omitempty"`
+
+	// Metrics defines metrics configuration for managed proxies.
+	Metrics *ProxyMetrics `json:"metrics,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// EnvoyProxyProvider defines the desired state of a resource provider.
+// +union
+type EnvoyProxyProvider struct {
+	// Type is the type of resource provider to use. A resource provider provides
+	// infrastructure resources for running the data plane, e.g. Envoy proxy, and
+	// optional auxiliary control planes. Supported types are "Kubernetes".
+	//
+	// +unionDiscriminator
+	Type ProviderType `json:"type"`
+	// Kubernetes defines the desired state of the Kubernetes resource provider.
+	// Kubernetes provides infrastructure resources for running the data plane,
+	// e.g. Envoy proxy. If unspecified and type is "Kubernetes", default settings
+	// for managed Kubernetes resources are applied.
+	//
+	// +optional
+	Kubernetes *EnvoyProxyKubernetesProvider `json:"kubernetes,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ShutdownConfig defines configuration for graceful envoy shutdown process.
+type ShutdownConfig struct {
+	// DrainTimeout defines the graceful drain timeout. This should be less than the pod's terminationGracePeriodSeconds.
+	// If unspecified, defaults to 600 seconds.
+	//
+	// +optional
+	DrainTimeout *metav1.Duration `json:"drainTimeout,omitempty"`
+	// MinDrainDuration defines the minimum drain duration allowing time for endpoint deprogramming to complete.
+	// If unspecified, defaults to 5 seconds.
+	//
+	// +optional
+	MinDrainDuration *metav1.Duration `json:"minDrainDuration,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// EnvoyProxyKubernetesProvider defines configuration for the Kubernetes resource
+// provider.
+type EnvoyProxyKubernetesProvider struct {
+	// EnvoyDeployment defines the desired state of the Envoy deployment resource.
+	// If unspecified, default settings for the managed Envoy deployment resource
+	// are applied.
+	//
+	// +optional
+	EnvoyDeployment *KubernetesDeploymentSpec `json:"envoyDeployment,omitempty"`
+
+	// EnvoyService defines the desired state of the Envoy service resource.
+	// If unspecified, default settings for the managed Envoy service resource
+	// are applied.
+	//
+	// +optional
+	EnvoyService *KubernetesServiceSpec `json:"envoyService,omitempty"`
+
+	// EnvoyHpa defines the Horizontal Pod Autoscaler settings for Envoy Proxy Deployment.
+	// Once the HPA is being set, Replicas field from EnvoyDeployment will be ignored.
+	//
+	// +optional
+	EnvoyHpa *KubernetesHorizontalPodAutoscalerSpec `json:"envoyHpa,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ProxyLogging defines logging parameters for managed proxies.
+type ProxyLogging struct {
+	// Level is a map of logging level per component, where the component is the key
+	// and the log level is the value. If unspecified, defaults to "default: warn".
+	//
+	// +kubebuilder:default={default: warn}
+	Level map[ProxyLogComponent]LogLevel `json:"level,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ProxyLogComponent defines a component that supports a configured logging level.
+// +kubebuilder:validation:Enum=system;upstream;http;connection;admin;client;filter;main;router;runtime
+type ProxyLogComponent string
+
+const (
+	// LogComponentDefault defines the default logging component.
+	// See more details: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#cmdoption-l
+	LogComponentDefault ProxyLogComponent = "default"
+
+	// LogComponentUpstream defines the "upstream" logging component.
+	LogComponentUpstream ProxyLogComponent = "upstream"
+
+	// LogComponentHTTP defines the "http" logging component.
+	LogComponentHTTP ProxyLogComponent = "http"
+
+	// LogComponentConnection defines the "connection" logging component.
+	LogComponentConnection ProxyLogComponent = "connection"
+
+	// LogComponentAdmin defines the "admin" logging component.
+	LogComponentAdmin ProxyLogComponent = "admin"
+
+	// LogComponentClient defines the "client" logging component.
+	LogComponentClient ProxyLogComponent = "client"
+
+	// LogComponentFilter defines the "filter" logging component.
+	LogComponentFilter ProxyLogComponent = "filter"
+
+	// LogComponentMain defines the "main" logging component.
+	LogComponentMain ProxyLogComponent = "main"
+
+	// LogComponentRouter defines the "router" logging component.
+	LogComponentRouter ProxyLogComponent = "router"
+
+	// LogComponentRuntime defines the "runtime" logging component.
+	LogComponentRuntime ProxyLogComponent = "runtime"
+)
+
+// +k8s:deepcopy-gen=true
+// ProxyBootstrap defines Envoy Bootstrap configuration.
+type ProxyBootstrap struct {
+	// Type is the type of the bootstrap configuration, it should be either Replace or Merge.
+	// If unspecified, it defaults to Replace.
+	// +optional
+	// +kubebuilder:default=Replace
+	Type *BootstrapType `json:"type"`
+
+	// Value is a YAML string of the bootstrap.
+	Value string `json:"value"`
+}
+
+// +k8s:deepcopy-gen=true
+// BootstrapType defines the types of bootstrap supported by Envoy Gateway.
+// +kubebuilder:validation:Enum=Merge;Replace
+type BootstrapType string
+
+const (
+	// Merge merges the provided bootstrap with the default one. The provided bootstrap can add or override a value
+	// within a map, or add a new value to a list.
+	// Please note that the provided bootstrap can't override a value within a list.
+	BootstrapTypeMerge BootstrapType = "Merge"
+
+	// Replace replaces the default bootstrap with the provided one.
+	BootstrapTypeReplace BootstrapType = "Replace"
+)
+
+// +k8s:deepcopy-gen=true
+// EnvoyProxyStatus defines the observed state of EnvoyProxy. This type is not implemented
+// until https://github.com/envoyproxy/gateway/issues/1007 is fixed.
+type EnvoyProxyStatus struct {
+	// INSERT ADDITIONAL STATUS FIELDS - define observed state of cluster.
+	// Important: Run "make" to regenerate code after modifying this file.
+}
+
+// +kubebuilder:object:root=true
+
+// EnvoyProxyList contains a list of EnvoyProxy
+type EnvoyProxyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []EnvoyProxy `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&EnvoyProxy{}, &EnvoyProxyList{})
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/groupversion_info.go b/adapter/internal/operator/gateway-api/v1alpha1/groupversion_info.go
new file mode 100644
index 000000000..ea5c3d8b0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/groupversion_info.go
@@ -0,0 +1,42 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+const GroupName = "dp.wso2.com"
+
+var (
+
+	// GroupVersion is group version used to register these objects
+	GroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/keepalive_types.go b/adapter/internal/operator/gateway-api/v1alpha1/keepalive_types.go
new file mode 100644
index 000000000..c261eecc7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/keepalive_types.go
@@ -0,0 +1,50 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// +k8s:deepcopy-gen=true
+// TCPKeepalive define the TCP Keepalive configuration.
+type TCPKeepalive struct {
+	// The total number of unacknowledged probes to send before deciding
+	// the connection is dead.
+	// Defaults to 9.
+	//
+	// +optional
+	Probes *uint32 `json:"probes,omitempty"`
+	// The duration a connection needs to be idle before keep-alive
+	// probes start being sent.
+	// The duration format is
+	// Defaults to `7200s`.
+	//
+	// +optional
+	IdleTime *gwapiv1.Duration `json:"idleTime,omitempty"`
+	// The duration between keep-alive probes.
+	// Defaults to `75s`.
+	//
+	// +optional
+	Interval *gwapiv1.Duration `json:"interval,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/kubernetes_helpers.go b/adapter/internal/operator/gateway-api/v1alpha1/kubernetes_helpers.go
new file mode 100644
index 000000000..48554a5df
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/kubernetes_helpers.go
@@ -0,0 +1,216 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	"encoding/json"
+	"fmt"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	appv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	"k8s.io/utils/ptr"
+)
+
+// DefaultKubernetesDeploymentStrategy returns the default deployment strategy settings.
+func DefaultKubernetesDeploymentStrategy() *appv1.DeploymentStrategy {
+	return &appv1.DeploymentStrategy{
+		Type: appv1.RollingUpdateDeploymentStrategyType,
+	}
+}
+
+// DefaultKubernetesContainerImage returns the default envoyproxy image.
+func DefaultKubernetesContainerImage(image string) *string {
+	return ptr.To(image)
+}
+
+// DefaultKubernetesDeployment returns a new KubernetesDeploymentSpec with default settings.
+func DefaultKubernetesDeployment(envoyProxyImage string, enforcerImage string) *KubernetesDeploymentSpec {
+	return &KubernetesDeploymentSpec{
+		Strategy:            DefaultKubernetesDeploymentStrategy(),
+		Pod:                 DefaultKubernetesPod(),
+		EnvoyProxyContainer: DefaultKubernetesContainer(envoyProxyImage),
+		EnforcerContainer:   DefaultKubernetesContainer(enforcerImage),
+	}
+}
+
+// DefaultKubernetesPod returns a new KubernetesPodSpec with default settings.
+func DefaultKubernetesPod() *KubernetesPodSpec {
+	return &KubernetesPodSpec{}
+}
+
+// DefaultKubernetesContainer returns a new KubernetesContainerSpec with default settings.
+func DefaultKubernetesContainer(image string) *KubernetesContainerSpec {
+	return &KubernetesContainerSpec{
+		Resources: DefaultResourceRequirements(),
+		Image:     DefaultKubernetesContainerImage(image),
+	}
+}
+
+// DefaultResourceRequirements returns a new ResourceRequirements with default settings.
+func DefaultResourceRequirements() *corev1.ResourceRequirements {
+	return &corev1.ResourceRequirements{
+		Requests: corev1.ResourceList{
+			corev1.ResourceCPU:    resource.MustParse(DefaultDeploymentCPUResourceRequests),
+			corev1.ResourceMemory: resource.MustParse(DefaultDeploymentMemoryResourceRequests),
+		},
+	}
+}
+
+// DefaultKubernetesService returns a new KubernetesServiceSpec with default settings.
+func DefaultKubernetesService() *KubernetesServiceSpec {
+	return &KubernetesServiceSpec{
+		Type:                  DefaultKubernetesServiceType(),
+		ExternalTrafficPolicy: DefaultKubernetesServiceExternalTrafficPolicy(),
+	}
+}
+
+// DefaultKubernetesServiceType returns a new KubernetesServiceType with default settings.
+func DefaultKubernetesServiceType() *ServiceType {
+	return GetKubernetesServiceType(ServiceTypeLoadBalancer)
+}
+
+// GetKubernetesServiceType returns the KubernetesServiceType pointer.
+func GetKubernetesServiceType(serviceType ServiceType) *ServiceType {
+	return &serviceType
+}
+
+func DefaultKubernetesServiceExternalTrafficPolicy() *ServiceExternalTrafficPolicy {
+	return GetKubernetesServiceExternalTrafficPolicy(ServiceExternalTrafficPolicyLocal)
+}
+
+func GetKubernetesServiceExternalTrafficPolicy(serviceExternalTrafficPolicy ServiceExternalTrafficPolicy) *ServiceExternalTrafficPolicy {
+	return &serviceExternalTrafficPolicy
+}
+
+// defaultKubernetesDeploymentSpec fill a default KubernetesDeploymentSpec if unspecified.
+func (deployment *KubernetesDeploymentSpec) defaultKubernetesDeploymentSpec(envoyProxyImage, enforcerImage string) {
+	if deployment.Strategy == nil {
+		deployment.Strategy = DefaultKubernetesDeploymentStrategy()
+	}
+
+	if deployment.Pod == nil {
+		deployment.Pod = DefaultKubernetesPod()
+	}
+
+	if deployment.EnvoyProxyContainer == nil {
+		deployment.EnvoyProxyContainer = DefaultKubernetesContainer(envoyProxyImage)
+	}
+
+	if deployment.EnvoyProxyContainer.Resources == nil {
+		deployment.EnvoyProxyContainer.Resources = DefaultResourceRequirements()
+	}
+
+	if deployment.EnvoyProxyContainer.Image == nil {
+		deployment.EnvoyProxyContainer.Image = ptr.To(envoyProxyImage)
+	}
+
+	if deployment.EnforcerContainer == nil {
+		deployment.EnforcerContainer = DefaultKubernetesContainer(enforcerImage)
+	}
+
+	if deployment.EnforcerContainer.Resources == nil {
+		deployment.EnforcerContainer.Resources = DefaultResourceRequirements()
+	}
+}
+
+// setDefault fill a default HorizontalPodAutoscalerSpec if unspecified
+func (hpa *KubernetesHorizontalPodAutoscalerSpec) setDefault() {
+	if len(hpa.Metrics) == 0 {
+		hpa.Metrics = DefaultEnvoyProxyHpaMetrics()
+	}
+}
+
+// ApplyMergePatch applies a merge patch to a deployment based on the merge type
+func (deployment *KubernetesDeploymentSpec) ApplyMergePatch(old *appv1.Deployment) (*appv1.Deployment, error) {
+	if deployment.Patch == nil {
+		return old, nil
+	}
+
+	var patchedJSON []byte
+	var err error
+
+	// Serialize the current deployment to JSON
+	originalJSON, err := json.Marshal(old)
+	if err != nil {
+		return nil, fmt.Errorf("error marshaling original deployment: %w", err)
+	}
+
+	switch {
+	case deployment.Patch.Type == nil || *deployment.Patch.Type == StrategicMerge:
+		patchedJSON, err = strategicpatch.StrategicMergePatch(originalJSON, deployment.Patch.Value.Raw, appv1.Deployment{})
+	case *deployment.Patch.Type == JSONMerge:
+		patchedJSON, err = jsonpatch.MergePatch(originalJSON, deployment.Patch.Value.Raw)
+	default:
+		return nil, fmt.Errorf("unsupported merge type: %s", *deployment.Patch.Type)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("error applying merge patch: %w", err)
+	}
+
+	// Deserialize the patched JSON into a new deployment object
+	var patchedDeployment appv1.Deployment
+	if err := json.Unmarshal(patchedJSON, &patchedDeployment); err != nil {
+		return nil, fmt.Errorf("error unmarshaling patched deployment: %w", err)
+	}
+
+	return &patchedDeployment, nil
+}
+
+// ApplyMergePatch applies a merge patch to a service based on the merge type
+func (service *KubernetesServiceSpec) ApplyMergePatch(old *corev1.Service) (*corev1.Service, error) {
+	if service.Patch == nil {
+		return old, nil
+	}
+
+	var patchedJSON []byte
+	var err error
+
+	// Serialize the current deployment to JSON
+	originalJSON, err := json.Marshal(old)
+	if err != nil {
+		return nil, fmt.Errorf("error marshaling original deployment: %w", err)
+	}
+
+	switch {
+	case service.Patch.Type == nil || *service.Patch.Type == StrategicMerge:
+		patchedJSON, err = strategicpatch.StrategicMergePatch(originalJSON, service.Patch.Value.Raw, corev1.Service{})
+	case *service.Patch.Type == JSONMerge:
+		patchedJSON, err = jsonpatch.MergePatch(originalJSON, service.Patch.Value.Raw)
+	default:
+		return nil, fmt.Errorf("unsupported merge type: %s", *service.Patch.Type)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("error applying merge patch: %w", err)
+	}
+
+	// Deserialize the patched JSON into a new service object
+	var patchedService corev1.Service
+	if err := json.Unmarshal(patchedJSON, &patchedService); err != nil {
+		return nil, fmt.Errorf("error unmarshaling patched service: %w", err)
+	}
+
+	return &patchedService, nil
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/retry_types.go b/adapter/internal/operator/gateway-api/v1alpha1/retry_types.go
new file mode 100644
index 000000000..2db40aad3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/retry_types.go
@@ -0,0 +1,129 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// Retry defines the retry strategy to be applied.
+type Retry struct {
+	// NumRetries is the number of retries to be attempted. Defaults to 2.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:default=2
+	NumRetries *int32 `json:"numRetries,omitempty"`
+
+	// RetryOn specifies the retry trigger condition.
+	//
+	// If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+	// +optional
+	RetryOn *RetryOn `json:"retryOn,omitempty"`
+
+	// PerRetry is the retry policy to be applied per retry attempt.
+	//
+	// +optional
+	PerRetry *PerRetryPolicy `json:"perRetry,omitempty"`
+}
+
+type RetryOn struct {
+	// Triggers specifies the retry trigger condition(Http/Grpc).
+	//
+	// +optional
+	Triggers []TriggerEnum `json:"triggers,omitempty"`
+
+	// HttpStatusCodes specifies the http status codes to be retried.
+	// The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+	//
+	// +optional
+	HTTPStatusCodes []HTTPStatus `json:"httpStatusCodes,omitempty"`
+}
+
+// TriggerEnum specifies the conditions that trigger retries.
+// +kubebuilder:validation:Enum={"5xx","gateway-error","reset","connect-failure","retriable-4xx","refused-stream","retriable-status-codes","cancelled","deadline-exceeded","internal","resource-exhausted","unavailable"}
+type TriggerEnum string
+
+const (
+	// HTTP events.
+	// For additional details, see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-on
+
+	// The upstream server responds with any 5xx response code, or does not respond at all (disconnect/reset/read timeout).
+	// Includes connect-failure and refused-stream.
+	Error5XX TriggerEnum = "5xx"
+	// The response is a gateway error (502,503 or 504).
+	GatewayError TriggerEnum = "gateway-error"
+	// The upstream server does not respond at all (disconnect/reset/read timeout.)
+	Reset TriggerEnum = "reset"
+	// Connection failure to the upstream server (connect timeout, etc.). (Included in *5xx*)
+	ConnectFailure TriggerEnum = "connect-failure"
+	// The upstream server responds with a retriable 4xx response code.
+	// Currently, the only response code in this category is 409.
+	Retriable4XX TriggerEnum = "retriable-4xx"
+	// The upstream server resets the stream with a REFUSED_STREAM error code.
+	RefusedStream TriggerEnum = "refused-stream"
+	// The upstream server responds with any response code matching one defined in the RetriableStatusCodes.
+	RetriableStatusCodes TriggerEnum = "retriable-status-codes"
+
+	// GRPC events, currently only supported for gRPC status codes in response headers.
+	// For additional details, see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-grpc-on
+
+	// The gRPC status code in the response headers is “cancelled”.
+	Cancelled TriggerEnum = "cancelled"
+	// The gRPC status code in the response headers is “deadline-exceeded”.
+	DeadlineExceeded TriggerEnum = "deadline-exceeded"
+	// The gRPC status code in the response headers is “internal”.
+	Internal TriggerEnum = "internal"
+	// The gRPC status code in the response headers is “resource-exhausted”.
+	ResourceExhausted TriggerEnum = "resource-exhausted"
+	// The gRPC status code in the response headers is “unavailable”.
+	Unavailable TriggerEnum = "unavailable"
+)
+
+type PerRetryPolicy struct {
+	// Timeout is the timeout per retry attempt.
+	//
+	// +optional
+	// +kubebuilder:validation:Format=duration
+	Timeout *metav1.Duration `json:"timeout,omitempty"`
+	// Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+	// back-off algorithm for retries. For additional details,
+	// see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+	//
+	// +optional
+	BackOff *BackOffPolicy `json:"backOff,omitempty"`
+}
+
+type BackOffPolicy struct {
+	// BaseInterval is the base interval between retries.
+	//
+	// +kubebuilder:validation:Format=duration
+	BaseInterval *metav1.Duration `json:"baseInterval,omitempty"`
+	// MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+	// The default is 10 times the base_interval
+	//
+	// +optional
+	// +kubebuilder:validation:Format=duration
+	MaxInterval *metav1.Duration `json:"maxInterval,omitempty"`
+	// we can add rate limited based backoff config here if we want to.
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go b/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
new file mode 100644
index 000000000..b3ccdb284
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
@@ -0,0 +1,447 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	appv1 "k8s.io/api/apps/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+)
+
+const (
+	// DefaultDeploymentReplicas is the default number of deployment replicas.
+	DefaultDeploymentReplicas = 1
+	// DefaultDeploymentCPUResourceRequests for deployment cpu resource
+	DefaultDeploymentCPUResourceRequests = "100m"
+	// DefaultDeploymentMemoryResourceRequests for deployment memory resource
+	DefaultDeploymentMemoryResourceRequests = "512Mi"
+	// DefaultEnvoyProxyImage is the default image used by envoyproxy
+	DefaultEnvoyProxyImage = "envoyproxy/envoy:distroless-v1.29.3"
+	// DefaultEnforcerImage default image used by enforcer
+	DefaultEnforcerImage = "wso2/apk-enforcer:1.1.0"
+	// DefaultShutdownManagerCPUResourceRequests for shutdown manager cpu resource
+	DefaultShutdownManagerCPUResourceRequests = "10m"
+	// DefaultShutdownManagerMemoryResourceRequests for shutdown manager memory resource
+	DefaultShutdownManagerMemoryResourceRequests = "32Mi"
+	// DefaultShutdownManagerImage is the default image used for the shutdown manager.
+	DefaultShutdownManagerImage = "envoyproxy/gateway-dev:latest"
+	// DefaultRateLimitImage is the default image used by ratelimit.
+	DefaultRateLimitImage = "envoyproxy/ratelimit:19f2079f"
+	// HTTPProtocol is the common-used http protocol.
+	HTTPProtocol = "http"
+	// GRPCProtocol is the common-used grpc protocol.
+	GRPCProtocol = "grpc"
+)
+
+// GroupVersionKind unambiguously identifies a Kind.
+// It can be converted to k8s.io/apimachinery/pkg/runtime/schema.GroupVersionKind
+type GroupVersionKind struct {
+	Group   string `json:"group"`
+	Version string `json:"version"`
+	Kind    string `json:"kind"`
+}
+
+// ProviderType defines the types of providers supported by Envoy Gateway.
+//
+// +kubebuilder:validation:Enum=Kubernetes
+type ProviderType string
+
+const (
+	// ProviderTypeKubernetes defines the "Kubernetes" provider.
+	ProviderTypeKubernetes ProviderType = "Kubernetes"
+
+	// ProviderTypeFile defines the "File" provider. This type is not implemented
+	// until https://github.com/envoyproxy/gateway/issues/1001 is fixed.
+	ProviderTypeFile ProviderType = "File"
+)
+
+// +k8s:deepcopy-gen=true
+// KubernetesDeploymentSpec defines the desired state of the Kubernetes deployment resource.
+type KubernetesDeploymentSpec struct {
+	// Patch defines how to perform the patch operation to deployment
+	//
+	// +optional
+	Patch *KubernetesPatchSpec `json:"patch,omitempty"`
+
+	// Replicas is the number of desired pods. Defaults to 1.
+	//
+	// +optional
+	Replicas *int32 `json:"replicas,omitempty"`
+
+	// The deployment strategy to use to replace existing pods with new ones.
+	// +optional
+	Strategy *appv1.DeploymentStrategy `json:"strategy,omitempty"`
+
+	// Pod defines the desired specification of pod.
+	//
+	// +optional
+	Pod *KubernetesPodSpec `json:"pod,omitempty"`
+
+	// EnvoyProxyContainer defines the desired specification of main container.
+	//
+	// +optional
+	EnvoyProxyContainer *KubernetesContainerSpec `json:"envoyProxyContainer,omitempty"`
+
+	// EnforcerContainer defines the desired specification of main container.
+	//
+	// +optional
+	EnforcerContainer *KubernetesContainerSpec `json:"enforcerContainer,omitempty"`
+
+	// List of initialization containers belonging to the pod.
+	// More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
+	//
+	// +optional
+	InitContainers []corev1.Container `json:"initContainers,omitempty"`
+
+	// TODO: Expose config as use cases are better understood, e.g. labels.
+}
+
+// +k8s:deepcopy-gen=true
+// KubernetesPodSpec defines the desired state of the Kubernetes pod resource.
+type KubernetesPodSpec struct {
+	// Annotations are the annotations that should be appended to the pods.
+	// By default, no pod annotations are appended.
+	//
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
+
+	// Labels are the additional labels that should be tagged to the pods.
+	// By default, no additional pod labels are tagged.
+	//
+	// +optional
+	Labels map[string]string `json:"labels,omitempty"`
+
+	// SecurityContext holds pod-level security attributes and common container settings.
+	// Optional: Defaults to empty.  See type description for default values of each field.
+	//
+	// +optional
+	SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
+
+	// If specified, the pod's scheduling constraints.
+	// +optional
+	Affinity *corev1.Affinity `json:"affinity,omitempty"`
+
+	// If specified, the pod's tolerations.
+	// +optional
+	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
+
+	// Volumes that can be mounted by containers belonging to the pod.
+	// More info: https://kubernetes.io/docs/concepts/storage/volumes
+	//
+	// +optional
+	Volumes []corev1.Volume `json:"volumes,omitempty"`
+
+	// ImagePullSecrets is an optional list of references to secrets
+	// in the same namespace to use for pulling any of the images used by this PodSpec.
+	// If specified, these secrets will be passed to individual puller implementations for them to use.
+	// More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
+	//
+	// +optional
+	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
+
+	// NodeSelector is a selector which must be true for the pod to fit on a node.
+	// Selector which must match a node's labels for the pod to be scheduled on that node.
+	// More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+	//
+	// +optional
+	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
+
+	// TopologySpreadConstraints describes how a group of pods ought to spread across topology
+	// domains. Scheduler will schedule pods in a way which abides by the constraints.
+	// All topologySpreadConstraints are ANDed.
+	//
+	// +optional
+	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// KubernetesContainerSpec defines the desired state of the Kubernetes container resource.
+type KubernetesContainerSpec struct {
+	// List of environment variables to set in the container.
+	//
+	// +optional
+	Env []corev1.EnvVar `json:"env,omitempty"`
+
+	// Resources required by this container.
+	// More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+	//
+	// +optional
+	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
+
+	// SecurityContext defines the security options the container should be run with.
+	// If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+	// More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+	//
+	// +optional
+	SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`
+
+	// Image specifies the EnvoyProxy container image to be used, instead of the default image.
+	//
+	// +optional
+	Image *string `json:"image,omitempty"`
+
+	// VolumeMounts are volumes to mount into the container's filesystem.
+	// Cannot be updated.
+	//
+	// +optional
+	VolumeMounts []corev1.VolumeMount `json:"volumeMounts,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ServiceType string describes ingress methods for a service
+// +enum
+// +kubebuilder:validation:Enum=ClusterIP;LoadBalancer;NodePort
+type ServiceType string
+
+const (
+	// ServiceTypeClusterIP means a service will only be accessible inside the
+	// cluster, via the cluster IP.
+	ServiceTypeClusterIP ServiceType = "ClusterIP"
+
+	// ServiceTypeLoadBalancer means a service will be exposed via an
+	// external load balancer (if the cloud provider supports it).
+	ServiceTypeLoadBalancer ServiceType = "LoadBalancer"
+
+	// ServiceTypeNodePort means a service will be exposed on each Kubernetes Node
+	// at a static Port, common across all Nodes.
+	ServiceTypeNodePort ServiceType = "NodePort"
+)
+
+// +k8s:deepcopy-gen=true
+// ServiceExternalTrafficPolicy describes how nodes distribute service traffic they
+// receive on one of the Service's "externally-facing" addresses (NodePorts, ExternalIPs,
+// and LoadBalancer IPs.
+// +enum
+// +kubebuilder:validation:Enum=Local;Cluster
+type ServiceExternalTrafficPolicy string
+
+const (
+	// ServiceExternalTrafficPolicyCluster routes traffic to all endpoints.
+	ServiceExternalTrafficPolicyCluster ServiceExternalTrafficPolicy = "Cluster"
+
+	// ServiceExternalTrafficPolicyLocal preserves the source IP of the traffic by
+	// routing only to endpoints on the same node as the traffic was received on
+	// (dropping the traffic if there are no local endpoints).
+	ServiceExternalTrafficPolicyLocal ServiceExternalTrafficPolicy = "Local"
+)
+
+// +k8s:deepcopy-gen=true
+// KubernetesServiceSpec defines the desired state of the Kubernetes service resource.
+// +kubebuilder:validation:XValidation:message="allocateLoadBalancerNodePorts can only be set for LoadBalancer type",rule="!has(self.allocateLoadBalancerNodePorts) || self.type == 'LoadBalancer'"
+// +kubebuilder:validation:XValidation:message="loadBalancerIP can only be set for LoadBalancer type",rule="!has(self.loadBalancerIP) || self.type == 'LoadBalancer'"
+type KubernetesServiceSpec struct {
+	// Annotations that should be appended to the service.
+	// By default, no annotations are appended.
+	//
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
+
+	// Type determines how the Service is exposed. Defaults to LoadBalancer.
+	// Valid options are ClusterIP, LoadBalancer and NodePort.
+	// "LoadBalancer" means a service will be exposed via an external load balancer (if the cloud provider supports it).
+	// "ClusterIP" means a service will only be accessible inside the cluster, via the cluster IP.
+	// "NodePort" means a service will be exposed on a static Port on all Nodes of the cluster.
+	// +kubebuilder:default:="LoadBalancer"
+	// +optional
+	Type *ServiceType `json:"type,omitempty"`
+
+	// LoadBalancerClass, when specified, allows for choosing the LoadBalancer provider
+	// implementation if more than one are available or is otherwise expected to be specified
+	// +optional
+	LoadBalancerClass *string `json:"loadBalancerClass,omitempty"`
+
+	// AllocateLoadBalancerNodePorts defines if NodePorts will be automatically allocated for
+	// services with type LoadBalancer. Default is "true". It may be set to "false" if the cluster
+	// load-balancer does not rely on NodePorts. If the caller requests specific NodePorts (by specifying a
+	// value), those requests will be respected, regardless of this field. This field may only be set for
+	// services with type LoadBalancer and will be cleared if the type is changed to any other type.
+	// +optional
+	AllocateLoadBalancerNodePorts *bool `json:"allocateLoadBalancerNodePorts,omitempty"`
+
+	// LoadBalancerIP defines the IP Address of the underlying load balancer service. This field
+	// may be ignored if the load balancer provider does not support this feature.
+	// This field has been deprecated in Kubernetes, but it is still used for setting the IP Address in some cloud
+	// providers such as GCP.
+	//
+	// +kubebuilder:validation:XValidation:message="loadBalancerIP must be a valid IPv4 address",rule="self.matches(r\"^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$\")"
+	// +optional
+	LoadBalancerIP *string `json:"loadBalancerIP,omitempty"`
+
+	// ExternalTrafficPolicy determines the externalTrafficPolicy for the Envoy Service. Valid options
+	// are Local and Cluster. Default is "Local". "Local" means traffic will only go to pods on the node
+	// receiving the traffic. "Cluster" means connections are loadbalanced to all pods in the cluster.
+	// +kubebuilder:default:="Local"
+	// +optional
+	ExternalTrafficPolicy *ServiceExternalTrafficPolicy `json:"externalTrafficPolicy,omitempty"`
+
+	// Patch defines how to perform the patch operation to the service
+	//
+	// +optional
+	Patch *KubernetesPatchSpec `json:"patch,omitempty"`
+	// TODO: Expose config as use cases are better understood, e.g. labels.
+}
+
+// +k8s:deepcopy-gen=true
+// LogLevel defines a log level for Envoy Gateway and EnvoyProxy system logs.
+// +kubebuilder:validation:Enum=debug;info;error;warn
+type LogLevel string
+
+const (
+	// LogLevelDebug defines the "debug" logging level.
+	LogLevelDebug LogLevel = "debug"
+
+	// LogLevelInfo defines the "Info" logging level.
+	LogLevelInfo LogLevel = "info"
+
+	// LogLevelWarn defines the "Warn" logging level.
+	LogLevelWarn LogLevel = "warn"
+
+	// LogLevelError defines the "Error" logging level.
+	LogLevelError LogLevel = "error"
+)
+
+// +k8s:deepcopy-gen=true
+// XDSTranslatorHook defines the types of hooks that an Envoy Gateway extension may support
+// for the xds-translator
+//
+// +kubebuilder:validation:Enum=VirtualHost;Route;HTTPListener;Translation
+type XDSTranslatorHook string
+
+const (
+	XDSVirtualHost  XDSTranslatorHook = "VirtualHost"
+	XDSRoute        XDSTranslatorHook = "Route"
+	XDSHTTPListener XDSTranslatorHook = "HTTPListener"
+	XDSTranslation  XDSTranslatorHook = "Translation"
+)
+
+// +k8s:deepcopy-gen=true
+// StringMatch defines how to match any strings.
+// This is a general purpose match condition that can be used by other EG APIs
+// that need to match against a string.
+type StringMatch struct {
+	// Type specifies how to match against a string.
+	//
+	// +optional
+	// +kubebuilder:default=Exact
+	Type *StringMatchType `json:"type,omitempty"`
+
+	// Value specifies the string value that the match must have.
+	//
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	Value string `json:"value"`
+}
+
+// +k8s:deepcopy-gen=true
+// StringMatchType specifies the semantics of how a string value should be compared.
+// Valid MatchType values are "Exact", "Prefix", "Suffix", "RegularExpression".
+//
+// +kubebuilder:validation:Enum=Exact;Prefix;Suffix;RegularExpression
+type StringMatchType string
+
+const (
+	// StringMatchExact :the input string must match exactly the match value.
+	StringMatchExact StringMatchType = "Exact"
+
+	// StringMatchPrefix :the input string must start with the match value.
+	StringMatchPrefix StringMatchType = "Prefix"
+
+	// StringMatchSuffix :the input string must end with the match value.
+	StringMatchSuffix StringMatchType = "Suffix"
+
+	// StringMatchRegularExpression :The input string must match the regular expression
+	// specified in the match value.
+	// The regex string must adhere to the syntax documented in
+	// https://github.com/google/re2/wiki/Syntax.
+	StringMatchRegularExpression StringMatchType = "RegularExpression"
+)
+
+// +k8s:deepcopy-gen=true
+// KubernetesHorizontalPodAutoscalerSpec defines Kubernetes Horizontal Pod Autoscaler settings of Envoy Proxy Deployment.
+// When HPA is enabled, it is recommended that the value in `KubernetesDeploymentSpec.replicas` be removed, otherwise
+// Envoy Gateway will revert back to this value every time reconciliation occurs.
+// See k8s.io.autoscaling.v2.HorizontalPodAutoScalerSpec.
+//
+// +kubebuilder:validation:XValidation:message="maxReplicas cannot be less than minReplicas",rule="!has(self.minReplicas) || self.maxReplicas >= self.minReplicas"
+type KubernetesHorizontalPodAutoscalerSpec struct {
+	// minReplicas is the lower limit for the number of replicas to which the autoscaler
+	// can scale down. It defaults to 1 replica.
+	//
+	// +kubebuilder:validation:XValidation:message="minReplicas must be greater than 0",rule="self > 0"
+	// +optional
+	MinReplicas *int32 `json:"minReplicas,omitempty"`
+
+	// maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.
+	// It cannot be less that minReplicas.
+	//
+	// +kubebuilder:validation:XValidation:message="maxReplicas must be greater than 0",rule="self > 0"
+	MaxReplicas *int32 `json:"maxReplicas"`
+
+	// metrics contains the specifications for which to use to calculate the
+	// desired replica count (the maximum replica count across all metrics will
+	// be used).
+	// If left empty, it defaults to being based on CPU utilization with average on 80% usage.
+	//
+	// +optional
+	Metrics []autoscalingv2.MetricSpec `json:"metrics,omitempty"`
+
+	// behavior configures the scaling behavior of the target
+	// in both Up and Down directions (scaleUp and scaleDown fields respectively).
+	// If not set, the default HPAScalingRules for scale up and scale down are used.
+	// See k8s.io.autoscaling.v2.HorizontalPodAutoScalerBehavior.
+	//
+	// +optional
+	Behavior *autoscalingv2.HorizontalPodAutoscalerBehavior `json:"behavior,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// HTTPStatus defines the http status code.
+// +kubebuilder:validation:Minimum=100
+// +kubebuilder:validation:Maximum=600
+// +kubebuilder:validation:ExclusiveMaximum=true
+type HTTPStatus int
+
+// +k8s:deepcopy-gen=true
+// MergeType defines the type of merge operation
+type MergeType string
+
+const (
+	// StrategicMerge indicates a strategic merge patch type
+	StrategicMerge MergeType = "StrategicMerge"
+	// JSONMerge indicates a JSON merge patch type
+	JSONMerge MergeType = "JSONMerge"
+)
+
+// +k8s:deepcopy-gen=true
+// KubernetesPatchSpec defines how to perform the patch operation
+type KubernetesPatchSpec struct {
+	// Type is the type of merge operation to perform
+	//
+	// By default, StrategicMerge is used as the patch type.
+	// +optional
+	Type *MergeType `json:"type,omitempty"`
+
+	// Object contains the raw configuration for merged object
+	Value apiextensionsv1.JSON `json:"value"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/timeout_types.go b/adapter/internal/operator/gateway-api/v1alpha1/timeout_types.go
new file mode 100644
index 000000000..d772a0660
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/timeout_types.go
@@ -0,0 +1,80 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+
+// +k8s:deepcopy-gen=true
+// Timeout defines configuration for timeouts related to connections.
+type Timeout struct {
+	// Timeout settings for TCP.
+	//
+	// +optional
+	TCP *TCPTimeout `json:"tcp,omitempty"`
+
+	// Timeout settings for HTTP.
+	//
+	// +optional
+	HTTP *HTTPTimeout `json:"http,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type TCPTimeout struct {
+	// The timeout for network connection establishment, including TCP and TLS handshakes.
+	// Default: 10 seconds.
+	//
+	// +optional
+	ConnectTimeout *gwapiv1.Duration `json:"connectTimeout,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type HTTPTimeout struct {
+	// The idle timeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
+	// Default: 1 hour.
+	//
+	// +optional
+	ConnectionIdleTimeout *gwapiv1.Duration `json:"connectionIdleTimeout,omitempty"`
+
+	// The maximum duration of an HTTP connection.
+	// Default: unlimited.
+	//
+	// +optional
+	MaxConnectionDuration *gwapiv1.Duration `json:"maxConnectionDuration,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type ClientTimeout struct {
+	// Timeout settings for HTTP.
+	//
+	// +optional
+	HTTP *HTTPClientTimeout `json:"http,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type HTTPClientTimeout struct {
+	// The duration envoy waits for the complete request reception. This timer starts upon request
+	// initiation and stops when either the last byte of the request is sent upstream or when the response begins.
+	//
+	// +optional
+	RequestReceivedTimeout *gwapiv1.Duration `json:"requestReceivedTimeout,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/tls_types.go b/adapter/internal/operator/gateway-api/v1alpha1/tls_types.go
new file mode 100644
index 000000000..0f1a8accb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/tls_types.go
@@ -0,0 +1,149 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// +k8s:deepcopy-gen=true
+// +kubebuilder:validation:XValidation:rule="has(self.minVersion) && self.minVersion == '1.3' ? !has(self.ciphers) : true", message="setting ciphers has no effect if the minimum possible TLS version is 1.3"
+// +kubebuilder:validation:XValidation:rule="has(self.minVersion) && has(self.maxVersion) ? {\"Auto\":0,\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4}[self.minVersion] <= {\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4,\"Auto\":5}[self.maxVersion] : !has(self.minVersion) && has(self.maxVersion) ? 3 <= {\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4,\"Auto\":5}[self.maxVersion] : true", message="minVersion must be smaller or equal to maxVersion"
+type TLSSettings struct {
+
+	// Min specifies the minimal TLS protocol version to allow.
+	// The default is TLS 1.2 if this is not specified.
+	//
+	// +optional
+	MinVersion *TLSVersion `json:"minVersion,omitempty"`
+
+	// Max specifies the maximal TLS protocol version to allow
+	// The default is TLS 1.3 if this is not specified.
+	//
+	// +optional
+	MaxVersion *TLSVersion `json:"maxVersion,omitempty"`
+
+	// Ciphers specifies the set of cipher suites supported when
+	// negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
+	// In non-FIPS Envoy Proxy builds the default cipher list is:
+	// - [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
+	// - [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
+	// - ECDHE-ECDSA-AES256-GCM-SHA384
+	// - ECDHE-RSA-AES256-GCM-SHA384
+	// In builds using BoringSSL FIPS the default cipher list is:
+	// - ECDHE-ECDSA-AES128-GCM-SHA256
+	// - ECDHE-RSA-AES128-GCM-SHA256
+	// - ECDHE-ECDSA-AES256-GCM-SHA384
+	// - ECDHE-RSA-AES256-GCM-SHA384
+	//
+	// +optional
+	Ciphers []string `json:"ciphers,omitempty"`
+
+	// ECDHCurves specifies the set of supported ECDH curves.
+	// In non-FIPS Envoy Proxy builds the default curves are:
+	// - X25519
+	// - P-256
+	// In builds using BoringSSL FIPS the default curve is:
+	// - P-256
+	//
+	// +optional
+	ECDHCurves []string `json:"ecdhCurves,omitempty"`
+
+	// SignatureAlgorithms specifies which signature algorithms the listener should
+	// support.
+	//
+	// +optional
+	SignatureAlgorithms []string `json:"signatureAlgorithms,omitempty"`
+
+	// ALPNProtocols supplies the list of ALPN protocols that should be
+	// exposed by the listener. By default h2 and http/1.1 are enabled.
+	// Supported values are:
+	// - http/1.0
+	// - http/1.1
+	// - h2
+	//
+	// +optional
+	ALPNProtocols []ALPNProtocol `json:"alpnProtocols,omitempty"`
+
+	// ClientValidation specifies the configuration to validate the client
+	// initiating the TLS connection to the Gateway listener.
+	// +optional
+	ClientValidation *ClientValidationContext `json:"clientValidation,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ALPNProtocol specifies the protocol to be negotiated using ALPN
+// +kubebuilder:validation:Enum=http/1.0;http/1.1;h2
+type ALPNProtocol string
+
+// When adding ALPN constants, they must be values that are defined
+// in the IANA registry for ALPN identification sequences
+// https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
+const (
+	// HTTPProtocolVersion1_0 specifies that HTTP/1.0 should be negotiable with ALPN
+	HTTPProtocolVersion1_0 ALPNProtocol = "http/1.0"
+	// HTTPProtocolVersion1_1 specifies that HTTP/1.1 should be negotiable with ALPN
+	HTTPProtocolVersion1_1 ALPNProtocol = "http/1.1"
+	// HTTPProtocolVersion2 specifies that HTTP/2 should be negotiable with ALPN
+	HTTPProtocolVersion2 ALPNProtocol = "h2"
+)
+
+// +k8s:deepcopy-gen=true
+// TLSVersion specifies the TLS version
+// +kubebuilder:validation:Enum=Auto;"1.0";"1.1";"1.2";"1.3"
+type TLSVersion string
+
+const (
+	// TLSAuto allows Envoy to choose the optimal TLS Version
+	TLSAuto TLSVersion = "Auto"
+	// TLS1.0 specifies TLS version 1.0
+	TLSv10 TLSVersion = "1.0"
+	// TLS1.1 specifies TLS version 1.1
+	TLSv11 TLSVersion = "1.1"
+	// TLSv1.2 specifies TLS version 1.2
+	TLSv12 TLSVersion = "1.2"
+	// TLSv1.3 specifies TLS version 1.3
+	TLSv13 TLSVersion = "1.3"
+)
+
+// +k8s:deepcopy-gen=true
+// ClientValidationContext holds configuration that can be used to validate the client initiating the TLS connection
+// to the Gateway.
+// By default, no client specific configuration is validated.
+type ClientValidationContext struct {
+	// CACertificateRefs contains one or more references to
+	// Kubernetes objects that contain TLS certificates of
+	// the Certificate Authorities that can be used
+	// as a trust anchor to validate the certificates presented by the client.
+	//
+	// A single reference to a Kubernetes ConfigMap or a Kubernetes Secret,
+	// with the CA certificate in a key named `ca.crt` is currently supported.
+	//
+	// References to a resource in different namespace are invalid UNLESS there
+	// is a ReferenceGrant in the target namespace that allows the certificate
+	// to be attached.
+	//
+	// +kubebuilder:validation:MaxItems=8
+	// +optional
+	CACertificateRefs []gwapiv1.SecretObjectReference `json:"caCertificateRefs,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/tracing_types.go b/adapter/internal/operator/gateway-api/v1alpha1/tracing_types.go
new file mode 100644
index 000000000..311cd482b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/tracing_types.go
@@ -0,0 +1,125 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+// +k8s:deepcopy-gen=true
+type ProxyTracing struct {
+	// SamplingRate controls the rate at which traffic will be
+	// selected for tracing if no prior sampling decision has been made.
+	// Defaults to 100, valid values [0-100]. 100 indicates 100% sampling.
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=100
+	// +kubebuilder:default=100
+	// +optional
+	SamplingRate *uint32 `json:"samplingRate,omitempty"`
+	// CustomTags defines the custom tags to add to each span.
+	// If provider is kubernetes, pod name and namespace are added by default.
+	CustomTags map[string]CustomTag `json:"customTags,omitempty"`
+	// Provider defines the tracing provider.
+	// Only OpenTelemetry is supported currently.
+	Provider TracingProvider `json:"provider"`
+}
+
+// +k8s:deepcopy-gen=true
+type TracingProviderType string
+
+const (
+	TracingProviderTypeOpenTelemetry TracingProviderType = "OpenTelemetry"
+)
+
+// +k8s:deepcopy-gen=true
+type TracingProvider struct {
+	// Type defines the tracing provider type.
+	// EG currently only supports OpenTelemetry.
+	// +kubebuilder:validation:Enum=OpenTelemetry
+	// +kubebuilder:default=OpenTelemetry
+	Type TracingProviderType `json:"type"`
+	// Host define the provider service hostname.
+	Host string `json:"host"`
+	// Port defines the port the provider service is exposed on.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:default=4317
+	Port int32 `json:"port,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type CustomTagType string
+
+const (
+	// CustomTagTypeLiteral adds hard-coded value to each span.
+	CustomTagTypeLiteral CustomTagType = "Literal"
+	// CustomTagTypeEnvironment adds value from environment variable to each span.
+	CustomTagTypeEnvironment CustomTagType = "Environment"
+	// CustomTagTypeRequestHeader adds value from request header to each span.
+	CustomTagTypeRequestHeader CustomTagType = "RequestHeader"
+)
+
+// +k8s:deepcopy-gen=true
+type CustomTag struct {
+	// Type defines the type of custom tag.
+	// +kubebuilder:validation:Enum=Literal;Environment;RequestHeader
+	// +unionDiscriminator
+	// +kubebuilder:default=Literal
+	Type CustomTagType `json:"type"`
+	// Literal adds hard-coded value to each span.
+	// It's required when the type is "Literal".
+	Literal *LiteralCustomTag `json:"literal,omitempty"`
+	// Environment adds value from environment variable to each span.
+	// It's required when the type is "Environment".
+	Environment *EnvironmentCustomTag `json:"environment,omitempty"`
+	// RequestHeader adds value from request header to each span.
+	// It's required when the type is "RequestHeader".
+	RequestHeader *RequestHeaderCustomTag `json:"requestHeader,omitempty"`
+
+	// TODO: add support for Metadata tags in the future.
+	// EG currently doesn't support metadata for route or cluster.
+}
+
+// +k8s:deepcopy-gen=true
+// LiteralCustomTag adds hard-coded value to each span.
+type LiteralCustomTag struct {
+	// Value defines the hard-coded value to add to each span.
+	Value string `json:"value"`
+}
+
+// +k8s:deepcopy-gen=true
+// EnvironmentCustomTag adds value from environment variable to each span.
+type EnvironmentCustomTag struct {
+	// Name defines the name of the environment variable which to extract the value from.
+	Name string `json:"name"`
+	// DefaultValue defines the default value to use if the environment variable is not set.
+	// +optional
+	DefaultValue *string `json:"defaultValue,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// RequestHeaderCustomTag adds value from request header to each span.
+type RequestHeaderCustomTag struct {
+	// Name defines the name of the request header which to extract the value from.
+	Name string `json:"name"`
+	// DefaultValue defines the default value to use if the request header is not set.
+	// +optional
+	DefaultValue *string `json:"defaultValue,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/zz_generated.deepcopy.go b/adapter/internal/operator/gateway-api/v1alpha1/zz_generated.deepcopy.go
new file mode 100644
index 000000000..0e34624ce
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/zz_generated.deepcopy.go
@@ -0,0 +1,1159 @@
+//go:build !ignore_autogenerated
+
+/*
+ *  Copyright (c) 2023, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	appsv1 "k8s.io/api/apps/v1"
+	"k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClientTimeout) DeepCopyInto(out *ClientTimeout) {
+	*out = *in
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPClientTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientTimeout.
+func (in *ClientTimeout) DeepCopy() *ClientTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(ClientTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClientValidationContext) DeepCopyInto(out *ClientValidationContext) {
+	*out = *in
+	if in.CACertificateRefs != nil {
+		in, out := &in.CACertificateRefs, &out.CACertificateRefs
+		*out = make([]apisv1.SecretObjectReference, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientValidationContext.
+func (in *ClientValidationContext) DeepCopy() *ClientValidationContext {
+	if in == nil {
+		return nil
+	}
+	out := new(ClientValidationContext)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CustomTag) DeepCopyInto(out *CustomTag) {
+	*out = *in
+	if in.Literal != nil {
+		in, out := &in.Literal, &out.Literal
+		*out = new(LiteralCustomTag)
+		**out = **in
+	}
+	if in.Environment != nil {
+		in, out := &in.Environment, &out.Environment
+		*out = new(EnvironmentCustomTag)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.RequestHeader != nil {
+		in, out := &in.RequestHeader, &out.RequestHeader
+		*out = new(RequestHeaderCustomTag)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CustomTag.
+func (in *CustomTag) DeepCopy() *CustomTag {
+	if in == nil {
+		return nil
+	}
+	out := new(CustomTag)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvironmentCustomTag) DeepCopyInto(out *EnvironmentCustomTag) {
+	*out = *in
+	if in.DefaultValue != nil {
+		in, out := &in.DefaultValue, &out.DefaultValue
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvironmentCustomTag.
+func (in *EnvironmentCustomTag) DeepCopy() *EnvironmentCustomTag {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvironmentCustomTag)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxy) DeepCopyInto(out *EnvoyProxy) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	out.Status = in.Status
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxy.
+func (in *EnvoyProxy) DeepCopy() *EnvoyProxy {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EnvoyProxy) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxyKubernetesProvider) DeepCopyInto(out *EnvoyProxyKubernetesProvider) {
+	*out = *in
+	if in.EnvoyDeployment != nil {
+		in, out := &in.EnvoyDeployment, &out.EnvoyDeployment
+		*out = new(KubernetesDeploymentSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.EnvoyService != nil {
+		in, out := &in.EnvoyService, &out.EnvoyService
+		*out = new(KubernetesServiceSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.EnvoyHpa != nil {
+		in, out := &in.EnvoyHpa, &out.EnvoyHpa
+		*out = new(KubernetesHorizontalPodAutoscalerSpec)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxyKubernetesProvider.
+func (in *EnvoyProxyKubernetesProvider) DeepCopy() *EnvoyProxyKubernetesProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxyKubernetesProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxyList) DeepCopyInto(out *EnvoyProxyList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]EnvoyProxy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxyList.
+func (in *EnvoyProxyList) DeepCopy() *EnvoyProxyList {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxyList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EnvoyProxyList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxyProvider) DeepCopyInto(out *EnvoyProxyProvider) {
+	*out = *in
+	if in.Kubernetes != nil {
+		in, out := &in.Kubernetes, &out.Kubernetes
+		*out = new(EnvoyProxyKubernetesProvider)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxyProvider.
+func (in *EnvoyProxyProvider) DeepCopy() *EnvoyProxyProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxyProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxySpec) DeepCopyInto(out *EnvoyProxySpec) {
+	*out = *in
+	if in.Provider != nil {
+		in, out := &in.Provider, &out.Provider
+		*out = new(EnvoyProxyProvider)
+		(*in).DeepCopyInto(*out)
+	}
+	in.Logging.DeepCopyInto(&out.Logging)
+	if in.Telemetry != nil {
+		in, out := &in.Telemetry, &out.Telemetry
+		*out = new(ProxyTelemetry)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Bootstrap != nil {
+		in, out := &in.Bootstrap, &out.Bootstrap
+		*out = new(ProxyBootstrap)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Concurrency != nil {
+		in, out := &in.Concurrency, &out.Concurrency
+		*out = new(int32)
+		**out = **in
+	}
+	if in.ExtraArgs != nil {
+		in, out := &in.ExtraArgs, &out.ExtraArgs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.MergeGateways != nil {
+		in, out := &in.MergeGateways, &out.MergeGateways
+		*out = new(bool)
+		**out = **in
+	}
+	if in.Shutdown != nil {
+		in, out := &in.Shutdown, &out.Shutdown
+		*out = new(ShutdownConfig)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxySpec.
+func (in *EnvoyProxySpec) DeepCopy() *EnvoyProxySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxyStatus) DeepCopyInto(out *EnvoyProxyStatus) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxyStatus.
+func (in *EnvoyProxyStatus) DeepCopy() *EnvoyProxyStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxyStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FileEnvoyProxyAccessLog) DeepCopyInto(out *FileEnvoyProxyAccessLog) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FileEnvoyProxyAccessLog.
+func (in *FileEnvoyProxyAccessLog) DeepCopy() *FileEnvoyProxyAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(FileEnvoyProxyAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) {
+	*out = *in
+	if in.RequestReceivedTimeout != nil {
+		in, out := &in.RequestReceivedTimeout, &out.RequestReceivedTimeout
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPClientTimeout.
+func (in *HTTPClientTimeout) DeepCopy() *HTTPClientTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPClientTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPTimeout) DeepCopyInto(out *HTTPTimeout) {
+	*out = *in
+	if in.ConnectionIdleTimeout != nil {
+		in, out := &in.ConnectionIdleTimeout, &out.ConnectionIdleTimeout
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+	if in.MaxConnectionDuration != nil {
+		in, out := &in.MaxConnectionDuration, &out.MaxConnectionDuration
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPTimeout.
+func (in *HTTPTimeout) DeepCopy() *HTTPTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesContainerSpec) DeepCopyInto(out *KubernetesContainerSpec) {
+	*out = *in
+	if in.Env != nil {
+		in, out := &in.Env, &out.Env
+		*out = make([]corev1.EnvVar, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Resources != nil {
+		in, out := &in.Resources, &out.Resources
+		*out = new(corev1.ResourceRequirements)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.SecurityContext != nil {
+		in, out := &in.SecurityContext, &out.SecurityContext
+		*out = new(corev1.SecurityContext)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Image != nil {
+		in, out := &in.Image, &out.Image
+		*out = new(string)
+		**out = **in
+	}
+	if in.VolumeMounts != nil {
+		in, out := &in.VolumeMounts, &out.VolumeMounts
+		*out = make([]corev1.VolumeMount, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesContainerSpec.
+func (in *KubernetesContainerSpec) DeepCopy() *KubernetesContainerSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesContainerSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesDeploymentSpec) DeepCopyInto(out *KubernetesDeploymentSpec) {
+	*out = *in
+	if in.Patch != nil {
+		in, out := &in.Patch, &out.Patch
+		*out = new(KubernetesPatchSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Replicas != nil {
+		in, out := &in.Replicas, &out.Replicas
+		*out = new(int32)
+		**out = **in
+	}
+	if in.Strategy != nil {
+		in, out := &in.Strategy, &out.Strategy
+		*out = new(appsv1.DeploymentStrategy)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Pod != nil {
+		in, out := &in.Pod, &out.Pod
+		*out = new(KubernetesPodSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.EnvoyProxyContainer != nil {
+		in, out := &in.EnvoyProxyContainer, &out.EnvoyProxyContainer
+		*out = new(KubernetesContainerSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.EnforcerContainer != nil {
+		in, out := &in.EnforcerContainer, &out.EnforcerContainer
+		*out = new(KubernetesContainerSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.InitContainers != nil {
+		in, out := &in.InitContainers, &out.InitContainers
+		*out = make([]corev1.Container, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesDeploymentSpec.
+func (in *KubernetesDeploymentSpec) DeepCopy() *KubernetesDeploymentSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesDeploymentSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesHorizontalPodAutoscalerSpec) DeepCopyInto(out *KubernetesHorizontalPodAutoscalerSpec) {
+	*out = *in
+	if in.MinReplicas != nil {
+		in, out := &in.MinReplicas, &out.MinReplicas
+		*out = new(int32)
+		**out = **in
+	}
+	if in.MaxReplicas != nil {
+		in, out := &in.MaxReplicas, &out.MaxReplicas
+		*out = new(int32)
+		**out = **in
+	}
+	if in.Metrics != nil {
+		in, out := &in.Metrics, &out.Metrics
+		*out = make([]v2.MetricSpec, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Behavior != nil {
+		in, out := &in.Behavior, &out.Behavior
+		*out = new(v2.HorizontalPodAutoscalerBehavior)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesHorizontalPodAutoscalerSpec.
+func (in *KubernetesHorizontalPodAutoscalerSpec) DeepCopy() *KubernetesHorizontalPodAutoscalerSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesHorizontalPodAutoscalerSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesPatchSpec) DeepCopyInto(out *KubernetesPatchSpec) {
+	*out = *in
+	if in.Type != nil {
+		in, out := &in.Type, &out.Type
+		*out = new(MergeType)
+		**out = **in
+	}
+	in.Value.DeepCopyInto(&out.Value)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesPatchSpec.
+func (in *KubernetesPatchSpec) DeepCopy() *KubernetesPatchSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesPatchSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesPodSpec) DeepCopyInto(out *KubernetesPodSpec) {
+	*out = *in
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.SecurityContext != nil {
+		in, out := &in.SecurityContext, &out.SecurityContext
+		*out = new(corev1.PodSecurityContext)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Affinity != nil {
+		in, out := &in.Affinity, &out.Affinity
+		*out = new(corev1.Affinity)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Tolerations != nil {
+		in, out := &in.Tolerations, &out.Tolerations
+		*out = make([]corev1.Toleration, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Volumes != nil {
+		in, out := &in.Volumes, &out.Volumes
+		*out = make([]corev1.Volume, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ImagePullSecrets != nil {
+		in, out := &in.ImagePullSecrets, &out.ImagePullSecrets
+		*out = make([]corev1.LocalObjectReference, len(*in))
+		copy(*out, *in)
+	}
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.TopologySpreadConstraints != nil {
+		in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints
+		*out = make([]corev1.TopologySpreadConstraint, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesPodSpec.
+func (in *KubernetesPodSpec) DeepCopy() *KubernetesPodSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesPodSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesServiceSpec) DeepCopyInto(out *KubernetesServiceSpec) {
+	*out = *in
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Type != nil {
+		in, out := &in.Type, &out.Type
+		*out = new(ServiceType)
+		**out = **in
+	}
+	if in.LoadBalancerClass != nil {
+		in, out := &in.LoadBalancerClass, &out.LoadBalancerClass
+		*out = new(string)
+		**out = **in
+	}
+	if in.AllocateLoadBalancerNodePorts != nil {
+		in, out := &in.AllocateLoadBalancerNodePorts, &out.AllocateLoadBalancerNodePorts
+		*out = new(bool)
+		**out = **in
+	}
+	if in.LoadBalancerIP != nil {
+		in, out := &in.LoadBalancerIP, &out.LoadBalancerIP
+		*out = new(string)
+		**out = **in
+	}
+	if in.ExternalTrafficPolicy != nil {
+		in, out := &in.ExternalTrafficPolicy, &out.ExternalTrafficPolicy
+		*out = new(ServiceExternalTrafficPolicy)
+		**out = **in
+	}
+	if in.Patch != nil {
+		in, out := &in.Patch, &out.Patch
+		*out = new(KubernetesPatchSpec)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesServiceSpec.
+func (in *KubernetesServiceSpec) DeepCopy() *KubernetesServiceSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesServiceSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LiteralCustomTag) DeepCopyInto(out *LiteralCustomTag) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LiteralCustomTag.
+func (in *LiteralCustomTag) DeepCopy() *LiteralCustomTag {
+	if in == nil {
+		return nil
+	}
+	out := new(LiteralCustomTag)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OpenTelemetryEnvoyProxyAccessLog) DeepCopyInto(out *OpenTelemetryEnvoyProxyAccessLog) {
+	*out = *in
+	if in.Resources != nil {
+		in, out := &in.Resources, &out.Resources
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenTelemetryEnvoyProxyAccessLog.
+func (in *OpenTelemetryEnvoyProxyAccessLog) DeepCopy() *OpenTelemetryEnvoyProxyAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(OpenTelemetryEnvoyProxyAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyAccessLog) DeepCopyInto(out *ProxyAccessLog) {
+	*out = *in
+	if in.Settings != nil {
+		in, out := &in.Settings, &out.Settings
+		*out = make([]ProxyAccessLogSetting, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyAccessLog.
+func (in *ProxyAccessLog) DeepCopy() *ProxyAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyAccessLogFormat) DeepCopyInto(out *ProxyAccessLogFormat) {
+	*out = *in
+	if in.Text != nil {
+		in, out := &in.Text, &out.Text
+		*out = new(string)
+		**out = **in
+	}
+	if in.JSON != nil {
+		in, out := &in.JSON, &out.JSON
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyAccessLogFormat.
+func (in *ProxyAccessLogFormat) DeepCopy() *ProxyAccessLogFormat {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyAccessLogFormat)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyAccessLogSetting) DeepCopyInto(out *ProxyAccessLogSetting) {
+	*out = *in
+	in.Format.DeepCopyInto(&out.Format)
+	if in.Sinks != nil {
+		in, out := &in.Sinks, &out.Sinks
+		*out = make([]ProxyAccessLogSink, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyAccessLogSetting.
+func (in *ProxyAccessLogSetting) DeepCopy() *ProxyAccessLogSetting {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyAccessLogSetting)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyAccessLogSink) DeepCopyInto(out *ProxyAccessLogSink) {
+	*out = *in
+	if in.File != nil {
+		in, out := &in.File, &out.File
+		*out = new(FileEnvoyProxyAccessLog)
+		**out = **in
+	}
+	if in.OpenTelemetry != nil {
+		in, out := &in.OpenTelemetry, &out.OpenTelemetry
+		*out = new(OpenTelemetryEnvoyProxyAccessLog)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyAccessLogSink.
+func (in *ProxyAccessLogSink) DeepCopy() *ProxyAccessLogSink {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyAccessLogSink)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyBootstrap) DeepCopyInto(out *ProxyBootstrap) {
+	*out = *in
+	if in.Type != nil {
+		in, out := &in.Type, &out.Type
+		*out = new(BootstrapType)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyBootstrap.
+func (in *ProxyBootstrap) DeepCopy() *ProxyBootstrap {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyBootstrap)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyLogging) DeepCopyInto(out *ProxyLogging) {
+	*out = *in
+	if in.Level != nil {
+		in, out := &in.Level, &out.Level
+		*out = make(map[ProxyLogComponent]LogLevel, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyLogging.
+func (in *ProxyLogging) DeepCopy() *ProxyLogging {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyLogging)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyMetricSink) DeepCopyInto(out *ProxyMetricSink) {
+	*out = *in
+	if in.OpenTelemetry != nil {
+		in, out := &in.OpenTelemetry, &out.OpenTelemetry
+		*out = new(ProxyOpenTelemetrySink)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyMetricSink.
+func (in *ProxyMetricSink) DeepCopy() *ProxyMetricSink {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyMetricSink)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyMetrics) DeepCopyInto(out *ProxyMetrics) {
+	*out = *in
+	if in.Prometheus != nil {
+		in, out := &in.Prometheus, &out.Prometheus
+		*out = new(ProxyPrometheusProvider)
+		**out = **in
+	}
+	if in.Sinks != nil {
+		in, out := &in.Sinks, &out.Sinks
+		*out = make([]ProxyMetricSink, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Matches != nil {
+		in, out := &in.Matches, &out.Matches
+		*out = make([]StringMatch, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyMetrics.
+func (in *ProxyMetrics) DeepCopy() *ProxyMetrics {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyMetrics)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyOpenTelemetrySink) DeepCopyInto(out *ProxyOpenTelemetrySink) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyOpenTelemetrySink.
+func (in *ProxyOpenTelemetrySink) DeepCopy() *ProxyOpenTelemetrySink {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyOpenTelemetrySink)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyPrometheusProvider) DeepCopyInto(out *ProxyPrometheusProvider) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyPrometheusProvider.
+func (in *ProxyPrometheusProvider) DeepCopy() *ProxyPrometheusProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyPrometheusProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyTelemetry) DeepCopyInto(out *ProxyTelemetry) {
+	*out = *in
+	if in.AccessLog != nil {
+		in, out := &in.AccessLog, &out.AccessLog
+		*out = new(ProxyAccessLog)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Tracing != nil {
+		in, out := &in.Tracing, &out.Tracing
+		*out = new(ProxyTracing)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Metrics != nil {
+		in, out := &in.Metrics, &out.Metrics
+		*out = new(ProxyMetrics)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyTelemetry.
+func (in *ProxyTelemetry) DeepCopy() *ProxyTelemetry {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyTelemetry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyTracing) DeepCopyInto(out *ProxyTracing) {
+	*out = *in
+	if in.SamplingRate != nil {
+		in, out := &in.SamplingRate, &out.SamplingRate
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.CustomTags != nil {
+		in, out := &in.CustomTags, &out.CustomTags
+		*out = make(map[string]CustomTag, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	out.Provider = in.Provider
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyTracing.
+func (in *ProxyTracing) DeepCopy() *ProxyTracing {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyTracing)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestHeaderCustomTag) DeepCopyInto(out *RequestHeaderCustomTag) {
+	*out = *in
+	if in.DefaultValue != nil {
+		in, out := &in.DefaultValue, &out.DefaultValue
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestHeaderCustomTag.
+func (in *RequestHeaderCustomTag) DeepCopy() *RequestHeaderCustomTag {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestHeaderCustomTag)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ShutdownConfig) DeepCopyInto(out *ShutdownConfig) {
+	*out = *in
+	if in.DrainTimeout != nil {
+		in, out := &in.DrainTimeout, &out.DrainTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.MinDrainDuration != nil {
+		in, out := &in.MinDrainDuration, &out.MinDrainDuration
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ShutdownConfig.
+func (in *ShutdownConfig) DeepCopy() *ShutdownConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ShutdownConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StringMatch) DeepCopyInto(out *StringMatch) {
+	*out = *in
+	if in.Type != nil {
+		in, out := &in.Type, &out.Type
+		*out = new(StringMatchType)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StringMatch.
+func (in *StringMatch) DeepCopy() *StringMatch {
+	if in == nil {
+		return nil
+	}
+	out := new(StringMatch)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPKeepalive) DeepCopyInto(out *TCPKeepalive) {
+	*out = *in
+	if in.Probes != nil {
+		in, out := &in.Probes, &out.Probes
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.IdleTime != nil {
+		in, out := &in.IdleTime, &out.IdleTime
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPKeepalive.
+func (in *TCPKeepalive) DeepCopy() *TCPKeepalive {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPKeepalive)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPTimeout) DeepCopyInto(out *TCPTimeout) {
+	*out = *in
+	if in.ConnectTimeout != nil {
+		in, out := &in.ConnectTimeout, &out.ConnectTimeout
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPTimeout.
+func (in *TCPTimeout) DeepCopy() *TCPTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSSettings) DeepCopyInto(out *TLSSettings) {
+	*out = *in
+	if in.MinVersion != nil {
+		in, out := &in.MinVersion, &out.MinVersion
+		*out = new(TLSVersion)
+		**out = **in
+	}
+	if in.MaxVersion != nil {
+		in, out := &in.MaxVersion, &out.MaxVersion
+		*out = new(TLSVersion)
+		**out = **in
+	}
+	if in.Ciphers != nil {
+		in, out := &in.Ciphers, &out.Ciphers
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ECDHCurves != nil {
+		in, out := &in.ECDHCurves, &out.ECDHCurves
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.SignatureAlgorithms != nil {
+		in, out := &in.SignatureAlgorithms, &out.SignatureAlgorithms
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ALPNProtocols != nil {
+		in, out := &in.ALPNProtocols, &out.ALPNProtocols
+		*out = make([]ALPNProtocol, len(*in))
+		copy(*out, *in)
+	}
+	if in.ClientValidation != nil {
+		in, out := &in.ClientValidation, &out.ClientValidation
+		*out = new(ClientValidationContext)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSSettings.
+func (in *TLSSettings) DeepCopy() *TLSSettings {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSSettings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Timeout) DeepCopyInto(out *Timeout) {
+	*out = *in
+	if in.TCP != nil {
+		in, out := &in.TCP, &out.TCP
+		*out = new(TCPTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Timeout.
+func (in *Timeout) DeepCopy() *Timeout {
+	if in == nil {
+		return nil
+	}
+	out := new(Timeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TracingProvider) DeepCopyInto(out *TracingProvider) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TracingProvider.
+func (in *TracingProvider) DeepCopy() *TracingProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(TracingProvider)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/adapter/internal/operator/gateway-api/validate.go b/adapter/internal/operator/gateway-api/validate.go
new file mode 100644
index 000000000..56f13a2c5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/validate.go
@@ -0,0 +1,916 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+	"strings"
+
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+func (t *Translator) validateBackendRef(backendRefContext BackendRefContext, parentRef *RouteParentContext, route RouteContext,
+	resources *Resources, backendNamespace string, routeKind gwapiv1.Kind) bool {
+	if !t.validateBackendRefFilters(backendRefContext, parentRef, route, routeKind) {
+		return false
+	}
+	backendRef := GetBackendRef(backendRefContext)
+
+	if !t.validateBackendRefGroup(backendRef, parentRef, route) {
+		return false
+	}
+	if !t.validateBackendRefKind(backendRef, parentRef, route) {
+		return false
+	}
+	if !t.validateBackendNamespace(backendRef, parentRef, route, resources, routeKind) {
+		return false
+	}
+	if !t.validateBackendPort(backendRef, parentRef, route) {
+		return false
+	}
+	protocol := v1.ProtocolTCP
+	if routeKind == KindUDPRoute {
+		protocol = v1.ProtocolUDP
+	}
+	backendRefKind := KindDerefOr(backendRef.Kind, KindService)
+	switch backendRefKind {
+	case KindService:
+		if !t.validateBackendService(backendRef, parentRef, resources, backendNamespace, route, protocol) {
+			return false
+		}
+	}
+	return true
+}
+
+func (t *Translator) validateBackendRefGroup(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
+	if backendRef.Group != nil && *backendRef.Group != "" && *backendRef.Group != GroupMultiClusterService {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonInvalidKind,
+			fmt.Sprintf("Group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) and %s are supported", GroupMultiClusterService),
+		)
+		return false
+	}
+	return true
+}
+
+func (t *Translator) validateBackendRefKind(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
+	if backendRef.Kind != nil && *backendRef.Kind != KindService && *backendRef.Kind != KindServiceImport {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonInvalidKind,
+			"Kind is invalid, only Service and MCS ServiceImport are supported",
+		)
+		return false
+	}
+	return true
+}
+
+func (t *Translator) validateBackendRefFilters(backendRef BackendRefContext, parentRef *RouteParentContext, route RouteContext, routeKind gwapiv1.Kind) bool {
+	var filtersLen int
+	switch routeKind {
+	case KindHTTPRoute:
+		filters := GetFilters(backendRef).([]gwapiv1.HTTPRouteFilter)
+		filtersLen = len(filters)
+	case KindGRPCRoute:
+		filters := GetFilters(backendRef).([]gwapiv1a2.GRPCRouteFilter)
+		filtersLen = len(filters)
+	default:
+		return true
+	}
+
+	if filtersLen > 0 {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			"UnsupportedRefValue",
+			"The filters field within BackendRef is not supported",
+		)
+		return false
+	}
+
+	return true
+}
+
+func (t *Translator) validateBackendNamespace(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext,
+	resources *Resources, routeKind gwapiv1.Kind) bool {
+	if backendRef.Namespace != nil && string(*backendRef.Namespace) != "" && string(*backendRef.Namespace) != route.GetNamespace() {
+		if !t.validateCrossNamespaceRef(
+			crossNamespaceFrom{
+				group:     gwapiv1.GroupName,
+				kind:      string(routeKind),
+				namespace: route.GetNamespace(),
+			},
+			crossNamespaceTo{
+				group:     GroupDerefOr(backendRef.Group, ""),
+				kind:      KindDerefOr(backendRef.Kind, KindService),
+				namespace: string(*backendRef.Namespace),
+				name:      string(backendRef.Name),
+			},
+			resources.ReferenceGrants,
+		) {
+			parentRef.SetCondition(route,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonRefNotPermitted,
+				fmt.Sprintf("Backend ref to %s %s/%s not permitted by any ReferenceGrant.", KindDerefOr(backendRef.Kind, KindService), *backendRef.Namespace, backendRef.Name),
+			)
+			return false
+		}
+	}
+	return true
+}
+
+func (t *Translator) validateBackendPort(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
+	if backendRef.Port == nil {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			"PortNotSpecified",
+			"A valid port number corresponding to a port on the Service must be specified",
+		)
+		return false
+	}
+	return true
+}
+func (t *Translator) validateBackendService(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, resources *Resources,
+	serviceNamespace string, route RouteContext, protocol v1.Protocol) bool {
+	service := resources.GetService(serviceNamespace, string(backendRef.Name))
+	if service == nil {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonBackendNotFound,
+			fmt.Sprintf("Service %s/%s not found", NamespaceDerefOr(backendRef.Namespace, route.GetNamespace()),
+				string(backendRef.Name)),
+		)
+		return false
+	}
+	var portFound bool
+	for _, port := range service.Spec.Ports {
+		portProtocol := port.Protocol
+		if port.Protocol == "" { // Default protocol is TCP
+			portProtocol = v1.ProtocolTCP
+		}
+		if port.Port == int32(*backendRef.Port) && portProtocol == protocol {
+			portFound = true
+			break
+		}
+	}
+
+	if !portFound {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			"PortNotFound",
+			fmt.Sprintf(string(protocol)+" Port %d not found on service %s/%s", *backendRef.Port, serviceNamespace,
+				string(backendRef.Name)),
+		)
+		return false
+	}
+	return true
+}
+
+func (t *Translator) validateListenerConditions(listener *ListenerContext) (isReady bool) {
+	lConditions := listener.GetConditions()
+	if len(lConditions) == 0 {
+		listener.SetCondition(gwapiv1.ListenerConditionProgrammed, metav1.ConditionTrue, gwapiv1.ListenerReasonProgrammed,
+			"Sending translated listener configuration to the data plane")
+		listener.SetCondition(gwapiv1.ListenerConditionAccepted, metav1.ConditionTrue, gwapiv1.ListenerReasonAccepted,
+			"Listener has been successfully translated")
+		listener.SetCondition(gwapiv1.ListenerConditionResolvedRefs, metav1.ConditionTrue, gwapiv1.ListenerReasonResolvedRefs,
+			"Listener references have been resolved")
+		return true
+	}
+
+	// Any condition on the listener apart from Programmed=true indicates an error.
+	if !(lConditions[0].Type == string(gwapiv1.ListenerConditionProgrammed) && lConditions[0].Status == metav1.ConditionTrue) {
+		hasProgrammedCond := false
+		hasRefsCond := false
+		for _, existing := range lConditions {
+			if existing.Type == string(gwapiv1.ListenerConditionProgrammed) {
+				hasProgrammedCond = true
+			}
+			if existing.Type == string(gwapiv1.ListenerConditionResolvedRefs) {
+				hasRefsCond = true
+			}
+		}
+		// set "Programmed: false" if it's not set already.
+		if !hasProgrammedCond {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				"Listener is invalid, see other Conditions for details.",
+			)
+		}
+		// set "ResolvedRefs: true" if it's not set already.
+		if !hasRefsCond {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.ListenerReasonResolvedRefs,
+				"Listener references have been resolved",
+			)
+		}
+		// skip computing IR
+		return false
+	}
+	return true
+}
+
+func (t *Translator) validateAllowedNamespaces(listener *ListenerContext) {
+	if listener.AllowedRoutes != nil &&
+		listener.AllowedRoutes.Namespaces != nil &&
+		listener.AllowedRoutes.Namespaces.From != nil &&
+		*listener.AllowedRoutes.Namespaces.From == gwapiv1.NamespacesFromSelector {
+		if listener.AllowedRoutes.Namespaces.Selector == nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				"The allowedRoutes.namespaces.selector field must be specified when allowedRoutes.namespaces.from is set to \"Selector\".",
+			)
+		} else {
+			selector, err := metav1.LabelSelectorAsSelector(listener.AllowedRoutes.Namespaces.Selector)
+			if err != nil {
+				listener.SetCondition(
+					gwapiv1.ListenerConditionProgrammed,
+					metav1.ConditionFalse,
+					gwapiv1.ListenerReasonInvalid,
+					fmt.Sprintf("The allowedRoutes.namespaces.selector could not be parsed: %v.", err),
+				)
+			}
+
+			listener.namespaceSelector = selector
+		}
+	}
+}
+
+func (t *Translator) validateTerminateModeAndGetTLSSecrets(listener *ListenerContext, resources *Resources) []*v1.Secret {
+	if len(listener.TLS.CertificateRefs) == 0 {
+		listener.SetCondition(
+			gwapiv1.ListenerConditionProgrammed,
+			metav1.ConditionFalse,
+			gwapiv1.ListenerReasonInvalid,
+			"Listener must have at least 1 TLS certificate ref",
+		)
+		return nil
+	}
+
+	secrets := make([]*v1.Secret, 0)
+	for _, certificateRef := range listener.TLS.CertificateRefs {
+		// TODO zhaohuabing: reuse validateSecretRef
+		if certificateRef.Group != nil && string(*certificateRef.Group) != "" {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidCertificateRef,
+				"Listener's TLS certificate ref group must be unspecified/empty.",
+			)
+			break
+		}
+
+		if certificateRef.Kind != nil && string(*certificateRef.Kind) != KindSecret {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf("Listener's TLS certificate ref kind must be %s.", KindSecret),
+			)
+			break
+		}
+
+		secretNamespace := listener.gateway.Namespace
+
+		if certificateRef.Namespace != nil && string(*certificateRef.Namespace) != "" && string(*certificateRef.Namespace) != listener.gateway.Namespace {
+			if !t.validateCrossNamespaceRef(
+				crossNamespaceFrom{
+					group:     gwapiv1.GroupName,
+					kind:      KindGateway,
+					namespace: listener.gateway.Namespace,
+				},
+				crossNamespaceTo{
+					group:     "",
+					kind:      KindSecret,
+					namespace: string(*certificateRef.Namespace),
+					name:      string(certificateRef.Name),
+				},
+				resources.ReferenceGrants,
+			) {
+				listener.SetCondition(
+					gwapiv1.ListenerConditionResolvedRefs,
+					metav1.ConditionFalse,
+					gwapiv1.ListenerReasonRefNotPermitted,
+					fmt.Sprintf("Certificate ref to secret %s/%s not permitted by any ReferenceGrant.", *certificateRef.Namespace, certificateRef.Name),
+				)
+				break
+			}
+
+			secretNamespace = string(*certificateRef.Namespace)
+		}
+
+		secret := resources.GetSecret(secretNamespace, string(certificateRef.Name))
+		if secret == nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf("Secret %s/%s does not exist.", listener.gateway.Namespace, certificateRef.Name),
+			)
+			break
+		}
+
+		if secret.Type != v1.SecretTypeTLS {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf("Secret %s/%s must be of type %s.", listener.gateway.Namespace, certificateRef.Name, v1.SecretTypeTLS),
+			)
+			break
+		}
+
+		if len(secret.Data[v1.TLSCertKey]) == 0 || len(secret.Data[v1.TLSPrivateKeyKey]) == 0 {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf("Secret %s/%s must contain %s and %s.", listener.gateway.Namespace, certificateRef.Name, v1.TLSCertKey, v1.TLSPrivateKeyKey),
+			)
+			break
+		}
+
+		secrets = append(secrets, secret)
+	}
+
+	err := validateTLSSecretsData(secrets, listener.Hostname)
+	if err != nil {
+		listener.SetCondition(
+			gwapiv1.ListenerConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1.ListenerReasonInvalidCertificateRef,
+			fmt.Sprintf("Secret %s.", err.Error()),
+		)
+	}
+
+	return secrets
+}
+
+func (t *Translator) validateTLSConfiguration(listener *ListenerContext, resources *Resources) {
+	switch listener.Protocol {
+	case gwapiv1.HTTPProtocolType, gwapiv1.UDPProtocolType, gwapiv1.TCPProtocolType:
+		if listener.TLS != nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				fmt.Sprintf("Listener must not have TLS set when protocol is %s.", listener.Protocol),
+			)
+		}
+	case gwapiv1.HTTPSProtocolType:
+		if listener.TLS == nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				fmt.Sprintf("Listener must have TLS set when protocol is %s.", listener.Protocol),
+			)
+			break
+		}
+
+		if listener.TLS.Mode != nil && *listener.TLS.Mode != gwapiv1.TLSModeTerminate {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				"UnsupportedTLSMode",
+				fmt.Sprintf("TLS %s mode is not supported, TLS mode must be Terminate.", *listener.TLS.Mode),
+			)
+			break
+		}
+
+		secrets := t.validateTerminateModeAndGetTLSSecrets(listener, resources)
+		listener.SetTLSSecrets(secrets)
+
+	case gwapiv1.TLSProtocolType:
+		if listener.TLS == nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				fmt.Sprintf("Listener must have TLS set when protocol is %s.", listener.Protocol),
+			)
+			break
+		}
+
+		if listener.TLS.Mode != nil && *listener.TLS.Mode == gwapiv1.TLSModePassthrough {
+			if len(listener.TLS.CertificateRefs) > 0 {
+				listener.SetCondition(
+					gwapiv1.ListenerConditionProgrammed,
+					metav1.ConditionFalse,
+					gwapiv1.ListenerReasonInvalid,
+					"Listener must not have TLS certificate refs set for TLS mode Passthrough.",
+				)
+				break
+			}
+		}
+
+		if listener.TLS.Mode != nil && *listener.TLS.Mode == gwapiv1.TLSModeTerminate {
+			if len(listener.TLS.CertificateRefs) == 0 {
+				listener.SetCondition(
+					gwapiv1.ListenerConditionProgrammed,
+					metav1.ConditionFalse,
+					gwapiv1.ListenerReasonInvalid,
+					"Listener must have TLS certificate refs set for TLS mode Terminate.",
+				)
+				break
+			}
+			secrets := t.validateTerminateModeAndGetTLSSecrets(listener, resources)
+			listener.SetTLSSecrets(secrets)
+		}
+	}
+}
+
+func (t *Translator) validateHostName(listener *ListenerContext) {
+	if listener.Protocol == gwapiv1.UDPProtocolType || listener.Protocol == gwapiv1.TCPProtocolType {
+		if listener.Hostname != nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				fmt.Sprintf("Listener must not have hostname set when protocol is %s.", listener.Protocol),
+			)
+		}
+	}
+}
+
+func (t *Translator) validateAllowedRoutes(listener *ListenerContext, routeKinds ...gwapiv1.Kind) {
+	canSupportKinds := make([]gwapiv1.RouteGroupKind, len(routeKinds))
+	for i, routeKind := range routeKinds {
+		canSupportKinds[i] = gwapiv1.RouteGroupKind{Group: GroupPtr(gwapiv1.GroupName), Kind: routeKind}
+	}
+	if listener.AllowedRoutes == nil || len(listener.AllowedRoutes.Kinds) == 0 {
+		listener.SetSupportedKinds(canSupportKinds...)
+		return
+	}
+
+	supportedRouteKinds := make([]gwapiv1.Kind, 0)
+	supportedKinds := make([]gwapiv1.RouteGroupKind, 0)
+	unSupportedKinds := make([]gwapiv1.RouteGroupKind, 0)
+
+	for _, kind := range listener.AllowedRoutes.Kinds {
+
+		// if there is a group it must match `gateway.networking.k8s.io`
+		if kind.Group != nil && string(*kind.Group) != gwapiv1.GroupName {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidRouteKinds,
+				fmt.Sprintf("Group is not supported, group must be %s", gwapiv1.GroupName),
+			)
+			continue
+		}
+
+		found := false
+		for _, routeKind := range routeKinds {
+			if kind.Kind == routeKind {
+				supportedKinds = append(supportedKinds, kind)
+				supportedRouteKinds = append(supportedRouteKinds, kind.Kind)
+				found = true
+				break
+			}
+		}
+
+		if !found {
+			unSupportedKinds = append(unSupportedKinds, kind)
+		}
+	}
+
+	for _, kind := range unSupportedKinds {
+		var printRouteKinds []gwapiv1.Kind
+		if len(supportedKinds) == 0 {
+			printRouteKinds = routeKinds
+		} else {
+			printRouteKinds = supportedRouteKinds
+		}
+		listener.SetCondition(
+			gwapiv1.ListenerConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1.ListenerReasonInvalidRouteKinds,
+			fmt.Sprintf("%s is not supported, kind must be one of %v", string(kind.Kind), printRouteKinds),
+		)
+	}
+
+	listener.SetSupportedKinds(supportedKinds...)
+}
+
+type portListeners struct {
+	listeners []*ListenerContext
+	protocols sets.Set[string]
+	hostnames map[string]int
+}
+
+// Port, protocol and hostname tuple should be unique across all listeners on merged Gateways.
+func (t *Translator) validateConflictedMergedListeners(gateways []*GatewayContext) {
+	listenerSets := sets.Set[string]{}
+	for _, gateway := range gateways {
+		for _, listener := range gateway.listeners {
+			hostname := new(gwapiv1.Hostname)
+			if listener.Hostname != nil {
+				hostname = listener.Hostname
+			}
+			portProtocolHostname := fmt.Sprintf("%s:%s:%d", listener.Protocol, *hostname, listener.Port)
+			if listenerSets.Has(portProtocolHostname) {
+				listener.SetCondition(
+					gwapiv1.ListenerConditionConflicted,
+					metav1.ConditionTrue,
+					gwapiv1.ListenerReasonHostnameConflict,
+					"Port, protocol and hostname tuple must be unique for every listener",
+				)
+			}
+			listenerSets.Insert(portProtocolHostname)
+		}
+	}
+}
+
+func (t *Translator) validateConflictedLayer7Listeners(gateways []*GatewayContext) {
+	// Iterate through all layer-7 (HTTP, HTTPS, TLS) listeners and collect info about protocols
+	// and hostnames per port.
+	for _, gateway := range gateways {
+		portListenerInfo := map[gwapiv1.PortNumber]*portListeners{}
+		for _, listener := range gateway.listeners {
+			if listener.Protocol == gwapiv1.UDPProtocolType || listener.Protocol == gwapiv1.TCPProtocolType {
+				continue
+			}
+			if portListenerInfo[listener.Port] == nil {
+				portListenerInfo[listener.Port] = &portListeners{
+					protocols: sets.Set[string]{},
+					hostnames: map[string]int{},
+				}
+			}
+
+			portListenerInfo[listener.Port].listeners = append(portListenerInfo[listener.Port].listeners, listener)
+
+			var protocol string
+			switch listener.Protocol {
+			// HTTPS and TLS can co-exist on the same port
+			case gwapiv1.HTTPSProtocolType, gwapiv1.TLSProtocolType:
+				protocol = "https/tls"
+			default:
+				protocol = string(listener.Protocol)
+			}
+			portListenerInfo[listener.Port].protocols.Insert(protocol)
+
+			var hostname string
+			if listener.Hostname != nil {
+				hostname = string(*listener.Hostname)
+			}
+
+			portListenerInfo[listener.Port].hostnames[hostname]++
+		}
+
+		// Set Conflicted conditions for any listeners with conflicting specs.
+		for _, info := range portListenerInfo {
+			for _, listener := range info.listeners {
+				if len(info.protocols) > 1 {
+					listener.SetCondition(
+						gwapiv1.ListenerConditionConflicted,
+						metav1.ConditionTrue,
+						gwapiv1.ListenerReasonProtocolConflict,
+						"All listeners for a given port must use a compatible protocol",
+					)
+				}
+
+				var hostname string
+				if listener.Hostname != nil {
+					hostname = string(*listener.Hostname)
+				}
+
+				if info.hostnames[hostname] > 1 {
+					listener.SetCondition(
+						gwapiv1.ListenerConditionConflicted,
+						metav1.ConditionTrue,
+						gwapiv1.ListenerReasonHostnameConflict,
+						"All listeners for a given port must use a unique hostname",
+					)
+				}
+			}
+		}
+	}
+}
+
+func (t *Translator) validateConflictedLayer4Listeners(gateways []*GatewayContext, protocols ...gwapiv1.ProtocolType) {
+	// Iterate through all layer-4(TCP UDP) listeners and check if there are more than one listener on the same port
+	for _, gateway := range gateways {
+		portListenerInfo := map[gwapiv1.PortNumber]*portListeners{}
+		for _, listener := range gateway.listeners {
+			for _, protocol := range protocols {
+				if listener.Protocol == protocol {
+					if portListenerInfo[listener.Port] == nil {
+						portListenerInfo[listener.Port] = &portListeners{}
+					}
+					portListenerInfo[listener.Port].listeners = append(portListenerInfo[listener.Port].listeners, listener)
+				}
+			}
+		}
+
+		// Leave the first one and set Conflicted conditions for all other listeners with conflicting specs.
+		for _, info := range portListenerInfo {
+			if len(info.listeners) > 1 {
+				for i := 1; i < len(info.listeners); i++ {
+					info.listeners[i].SetCondition(
+						gwapiv1.ListenerConditionConflicted,
+						metav1.ConditionTrue,
+						gwapiv1.ListenerReasonProtocolConflict,
+						fmt.Sprintf("Only one %s listener is allowed in a given port", strings.Join(protocolSliceToStringSlice(protocols), "/")),
+					)
+				}
+			}
+		}
+	}
+}
+
+func (t *Translator) validateCrossNamespaceRef(from crossNamespaceFrom, to crossNamespaceTo, referenceGrants []*gwapiv1b1.ReferenceGrant) bool {
+	for _, referenceGrant := range referenceGrants {
+		// The ReferenceGrant must be defined in the namespace of
+		// the "to" (the referent).
+		if referenceGrant.Namespace != to.namespace {
+			continue
+		}
+
+		// Check if the ReferenceGrant has a matching "from".
+		var fromAllowed bool
+		for _, refGrantFrom := range referenceGrant.Spec.From {
+			if string(refGrantFrom.Namespace) == from.namespace && string(refGrantFrom.Group) == from.group && string(refGrantFrom.Kind) == from.kind {
+				fromAllowed = true
+				break
+			}
+		}
+		if !fromAllowed {
+			continue
+		}
+
+		// Check if the ReferenceGrant has a matching "to".
+		var toAllowed bool
+		for _, refGrantTo := range referenceGrant.Spec.To {
+			if string(refGrantTo.Group) == to.group && string(refGrantTo.Kind) == to.kind && (refGrantTo.Name == nil || *refGrantTo.Name == "" || string(*refGrantTo.Name) == to.name) {
+				toAllowed = true
+				break
+			}
+		}
+		if !toAllowed {
+			continue
+		}
+
+		// If we got here, both the "from" and the "to" were allowed by this
+		// reference grant.
+		return true
+	}
+
+	// If we got here, no reference policy or reference grant allowed both the "from" and "to".
+	return false
+}
+
+// Checks if a hostname is valid according to RFC 1123 and gateway API's requirement that it not be an IP address
+func (t *Translator) validateHostname(hostname string) error {
+	if errs := validation.IsDNS1123Subdomain(hostname); errs != nil {
+		return fmt.Errorf("hostname %q is invalid: %v", hostname, errs)
+	}
+
+	// IP addresses are not allowed so parsing the hostname as an address needs to fail
+	if _, err := netip.ParseAddr(hostname); err == nil {
+		return fmt.Errorf("hostname: %q cannot be an ip address", hostname)
+	}
+
+	labelIdx := 0
+	for i := range hostname {
+		if hostname[i] == '.' {
+
+			if i-labelIdx > 63 {
+				return fmt.Errorf("label: %q in hostname %q cannot exceed 63 characters", hostname[labelIdx:i], hostname)
+			}
+			labelIdx = i + 1
+		}
+	}
+	// Check the last label
+	if len(hostname)-labelIdx > 63 {
+		return fmt.Errorf("label: %q in hostname %q cannot exceed 63 characters", hostname[labelIdx:], hostname)
+	}
+
+	return nil
+}
+
+// validateSecretRef checks three things:
+//  1. Does the secret reference have a valid Group and kind
+//  2. If the secret reference is a cross-namespace reference,
+//     is it permitted by any ReferenceGrant
+//  3. Does the secret exist
+func (t *Translator) validateSecretRef(
+	allowCrossNamespace bool,
+	from crossNamespaceFrom,
+	secretObjRef gwapiv1b1.SecretObjectReference,
+	resources *Resources) (*v1.Secret, error) {
+
+	if err := t.validateSecretObjectRef(allowCrossNamespace, from, secretObjRef, resources); err != nil {
+		return nil, err
+	}
+
+	secretNamespace := from.namespace
+	if secretObjRef.Namespace != nil {
+		secretNamespace = string(*secretObjRef.Namespace)
+	}
+	secret := resources.GetSecret(secretNamespace, string(secretObjRef.Name))
+
+	if secret == nil {
+		return nil, fmt.Errorf(
+			"secret %s/%s does not exist", secretNamespace, secretObjRef.Name)
+	}
+
+	return secret, nil
+}
+
+func (t *Translator) validateConfigMapRef(
+	allowCrossNamespace bool,
+	from crossNamespaceFrom,
+	secretObjRef gwapiv1b1.SecretObjectReference,
+	resources *Resources) (*v1.ConfigMap, error) {
+
+	if err := t.validateSecretObjectRef(allowCrossNamespace, from, secretObjRef, resources); err != nil {
+		return nil, err
+	}
+
+	configMapNamespace := from.namespace
+	if secretObjRef.Namespace != nil {
+		configMapNamespace = string(*secretObjRef.Namespace)
+	}
+	configMap := resources.GetConfigMap(configMapNamespace, string(secretObjRef.Name))
+
+	if configMap == nil {
+		return nil, fmt.Errorf(
+			"configmap %s/%s does not exist", configMapNamespace, secretObjRef.Name)
+	}
+
+	return configMap, nil
+}
+
+func (t *Translator) validateSecretObjectRef(
+	allowCrossNamespace bool,
+	from crossNamespaceFrom,
+	secretRef gwapiv1b1.SecretObjectReference,
+	resources *Resources) error {
+	var kind string
+	if secretRef.Group != nil && string(*secretRef.Group) != "" {
+		return errors.New("secret ref group must be unspecified/empty")
+	}
+
+	if secretRef.Kind == nil { // nolint
+		kind = KindSecret
+	} else if string(*secretRef.Kind) == KindSecret {
+		kind = KindSecret
+	} else if string(*secretRef.Kind) == KindConfigMap {
+		kind = KindConfigMap
+	} else {
+		return fmt.Errorf("secret ref kind must be %s", KindSecret)
+	}
+
+	if secretRef.Namespace != nil &&
+		string(*secretRef.Namespace) != "" &&
+		string(*secretRef.Namespace) != from.namespace {
+		if !allowCrossNamespace {
+			return fmt.Errorf(
+				"secret ref namespace must be unspecified/empty or %s",
+				from.namespace)
+		}
+
+		if !t.validateCrossNamespaceRef(
+			from,
+			crossNamespaceTo{
+				group:     "",
+				kind:      kind,
+				namespace: string(*secretRef.Namespace),
+				name:      string(secretRef.Name),
+			},
+			resources.ReferenceGrants,
+		) {
+			return fmt.Errorf(
+				"certificate ref to secret %s/%s not permitted by any ReferenceGrant",
+				*secretRef.Namespace, secretRef.Name)
+		}
+
+	}
+
+	return nil
+}
+
+// TODO: zhaohuabing combine this function with the one in the route translator
+// validateExtServiceBackendReference validates the backend reference for an
+// external service referenced by an EG policy.
+// This can also be used for the other external services deployed in the cluster,
+// such as the external processing filter, gRPC Access Log Service, etc.
+// It checks:
+//  1. The group is nil or empty, indicating the core API group.
+//  2. The kind is Service.
+//  3. The port is specified.
+//  4. The service exists and the specified port is found.
+//  5. The cross-namespace reference is permitted by the ReferenceGrants if the
+//     namespace is different from the policy's namespace.
+func (t *Translator) validateExtServiceBackendReference(
+	backendRef *gwapiv1.BackendObjectReference,
+	ownerNamespace string,
+	resources *Resources) error {
+
+	// These are sanity checks, they should never happen because the API server
+	// should have caught them
+	if backendRef.Group != nil && *backendRef.Group != "" {
+		return errors.New(
+			"group is invalid, only the core API group (specified by omitting" +
+				" the group field or setting it to an empty string) is supported")
+	}
+	if backendRef.Kind != nil && *backendRef.Kind != KindService {
+		return errors.New("kind is invalid, only Service (specified by omitting " +
+			"the kind field or setting it to 'Service') is supported")
+	}
+	if backendRef.Port == nil {
+		return errors.New("a valid port number corresponding to a port on the Service must be specified")
+	}
+
+	// check if the service is valid
+	serviceNamespace := NamespaceDerefOr(backendRef.Namespace, ownerNamespace)
+	service := resources.GetService(serviceNamespace, string(backendRef.Name))
+	if service == nil {
+		return fmt.Errorf("service %s/%s not found", serviceNamespace, backendRef.Name)
+	}
+	var portFound bool
+	for _, port := range service.Spec.Ports {
+		portProtocol := port.Protocol
+		if port.Protocol == "" { // Default protocol is TCP
+			portProtocol = v1.ProtocolTCP
+		}
+		// currently only HTTP and GRPC are supported, both of which are TCP
+		if port.Port == int32(*backendRef.Port) && portProtocol == v1.ProtocolTCP {
+			portFound = true
+			break
+		}
+	}
+
+	if !portFound {
+		return fmt.Errorf(
+			"TCP Port %d not found on service %s/%s",
+			*backendRef.Port, serviceNamespace, string(backendRef.Name),
+		)
+	}
+
+	// check if the cross-namespace reference is permitted
+	// if backendRef.Namespace != nil && string(*backendRef.Namespace) != "" &&
+	// 	string(*backendRef.Namespace) != ownerNamespace {
+	// 	if !t.validateCrossNamespaceRef(
+	// 		crossNamespaceFrom{
+	// 			group:     egv1a1.GroupName,
+	// 			kind:      KindSecurityPolicy,
+	// 			namespace: ownerNamespace,
+	// 		},
+	// 		crossNamespaceTo{
+	// 			group:     GroupDerefOr(backendRef.Group, ""),
+	// 			kind:      KindDerefOr(backendRef.Kind, KindService),
+	// 			namespace: string(*backendRef.Namespace),
+	// 			name:      string(backendRef.Name),
+	// 		},
+	// 		resources.ReferenceGrants,
+	// 	) {
+	// 		return fmt.Errorf(
+	// 			"backend ref to %s %s/%s not permitted by any ReferenceGrant",
+	// 			KindService, *backendRef.Namespace, backendRef.Name)
+	// 	}
+	// }
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/version/version.go b/adapter/internal/operator/gateway-api/version/version.go
new file mode 100644
index 000000000..64440dd3a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/version/version.go
@@ -0,0 +1,97 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package version
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"runtime/debug"
+	"strings"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	"sigs.k8s.io/yaml"
+)
+
+type Info struct {
+	EnvoyGatewayVersion    string `json:"envoyGatewayVersion"`
+	GatewayAPIVersion      string `json:"gatewayAPIVersion"`
+	EnvoyProxyVersion      string `json:"envoyProxyVersion"`
+	EnforcerVersion        string `json:"enforcerVersion"`
+	ShutdownManagerVersion string `json:"shutdownManagerVersion"`
+	GitCommitID            string `json:"gitCommitID"`
+}
+
+func Get() Info {
+	return Info{
+		EnvoyGatewayVersion:    envoyGatewayVersion,
+		GatewayAPIVersion:      gatewayAPIVersion,
+		EnvoyProxyVersion:      envoyProxyVersion,
+		EnforcerVersion:        enforcerVersion,
+		ShutdownManagerVersion: shutdownManagerVersion,
+		GitCommitID:            gitCommitID,
+	}
+}
+
+var (
+	envoyGatewayVersion    string
+	gatewayAPIVersion      string
+	envoyProxyVersion      = strings.Split(v1alpha1.DefaultEnvoyProxyImage, ":")[1]
+	enforcerVersion        = strings.Split(v1alpha1.DefaultEnforcerImage, ":")[1]
+	shutdownManagerVersion string
+	gitCommitID            string
+)
+
+func init() {
+	bi, ok := debug.ReadBuildInfo()
+	if ok {
+		for _, dep := range bi.Deps {
+			if dep.Path == "sigs.k8s.io/gateway-api" {
+				gatewayAPIVersion = dep.Version
+			}
+		}
+	}
+}
+
+// Print shows the versions of the Envoy Gateway.
+func Print(w io.Writer, format string) error {
+	v := Get()
+	switch format {
+	case "json":
+		if marshalled, err := json.MarshalIndent(v, "", "  "); err == nil {
+			_, _ = fmt.Fprintln(w, string(marshalled))
+		}
+	case "yaml":
+		if marshalled, err := yaml.Marshal(v); err == nil {
+			_, _ = fmt.Fprintln(w, string(marshalled))
+		}
+	default:
+		_, _ = fmt.Fprintf(w, "ENVOY_GATEWAY_VERSION: %s\n", v.EnvoyGatewayVersion)
+		_, _ = fmt.Fprintf(w, "ENVOY_PROXY_VERSION: %s\n", v.EnvoyProxyVersion)
+		_, _ = fmt.Fprintf(w, "GATEWAYAPI_VERSION: %s\n", v.GatewayAPIVersion)
+		_, _ = fmt.Fprintf(w, "SHUTDOWN_MANAGER_VERSION: %s\n", v.ShutdownManagerVersion)
+		_, _ = fmt.Fprintf(w, "GIT_COMMIT_ID: %s\n", v.GitCommitID)
+	}
+
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/xds/cache/snapshotcache.go b/adapter/internal/operator/gateway-api/xds/cache/snapshotcache.go
new file mode 100644
index 000000000..c9b217ae5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/xds/cache/snapshotcache.go
@@ -0,0 +1,333 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+// This file contains code derived from Contour,
+// https://github.com/projectcontour/contour
+// from the source file
+// https://github.com/projectcontour/contour/blob/main/internal/xds/v3/snapshotter.go
+// and is provided here subject to the following:
+// Copyright Project Contour Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package cache
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"strconv"
+	"sync"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	discoveryv3 "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
+	cachev3 "github.com/envoyproxy/go-control-plane/pkg/cache/v3"
+	serverv3 "github.com/envoyproxy/go-control-plane/pkg/server/v3"
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/types"
+)
+
+var Hash = cachev3.IDHash{}
+
+// SnapshotCacheWithCallbacks uses the go-control-plane SimpleCache to store snapshots of
+// Envoy resources, sliced by Node ID so that we can do incremental xDS properly.
+// It does this by also implementing callbacks to make sure that the cache is kept
+// up to date for each new node.
+//
+// Having the cache also implement the callbacks is a little bit hacky, but it makes sure
+// that all the required bookkeeping happens.
+// TODO(youngnick): Talk to the go-control-plane maintainers and see if we can upstream
+// this in a better way.
+type SnapshotCacheWithCallbacks interface {
+	cachev3.SnapshotCache
+	serverv3.Callbacks
+	GenerateNewSnapshot(string, types.XdsResources) error
+}
+
+type snapshotMap map[string]*cachev3.Snapshot
+
+type nodeInfoMap map[int64]*corev3.Node
+
+type snapshotCache struct {
+	cachev3.SnapshotCache
+	streamIDNodeInfo nodeInfoMap
+	snapshotVersion  int64
+	lastSnapshot     snapshotMap
+	mu               sync.Mutex
+}
+
+// GenerateNewSnapshot takes a table of resources (the output from the IR->xDS
+// translator) and updates the snapshot version.
+func (s *snapshotCache) GenerateNewSnapshot(irKey string, resources types.XdsResources) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	version := s.newSnapshotVersion()
+
+	// Create a snapshot with all xDS resources.
+	snapshot, err := cachev3.NewSnapshot(
+		version,
+		resources,
+	)
+	if err != nil {
+		return err
+	}
+
+	s.lastSnapshot[irKey] = snapshot
+
+	for _, node := range s.getNodeIDs(irKey) {
+		loggers.LoggerAPKOperator.Debugf("Generating a snapshot with Node %s", node)
+		err := s.SetSnapshot(context.TODO(), node, snapshot)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// newSnapshotVersion increments the current snapshotVersion
+// and returns as a string.
+func (s *snapshotCache) newSnapshotVersion() string {
+	// Reset the snapshotVersion if it ever hits max size.
+	if s.snapshotVersion == math.MaxInt64 {
+		s.snapshotVersion = 0
+	}
+
+	// Increment the snapshot version & return as string.
+	s.snapshotVersion++
+	return strconv.FormatInt(s.snapshotVersion, 10)
+}
+
+// NewSnapshotCache gives you a fresh SnapshotCache.
+// It needs a logger that supports the go-control-plane
+// required interface (Debugf, Infof, Warnf, and Errorf).
+func NewSnapshotCache(ads bool) SnapshotCacheWithCallbacks {
+	// // Set up the nasty wrapper hack.
+	// wrappedLogger := logger.Sugar()
+	//todo(amali) check the logger passing
+	return &snapshotCache{
+		SnapshotCache:    cachev3.NewSnapshotCache(ads, &Hash, loggers.LoggerAPKOperator),
+		lastSnapshot:     make(snapshotMap),
+		streamIDNodeInfo: make(nodeInfoMap),
+	}
+}
+
+// getNodeIDs retrieves the node ids from the node info map whose
+// cluster field matches the ir key
+func (s *snapshotCache) getNodeIDs(irKey string) []string {
+	var nodeIDs []string
+	for _, node := range s.streamIDNodeInfo {
+		if node != nil && node.Cluster == irKey {
+			nodeIDs = append(nodeIDs, node.Id)
+		}
+	}
+
+	return nodeIDs
+}
+
+// OnStreamOpen and the other OnStream* functions implement the callbacks for the
+// state-of-the-world stream types.
+func (s *snapshotCache) OnStreamOpen(_ context.Context, streamID int64, _ string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.streamIDNodeInfo[streamID] = nil
+
+	return nil
+}
+
+func (s *snapshotCache) OnStreamClosed(streamID int64, _ *corev3.Node) {
+	// TODO: something with the node?
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.streamIDNodeInfo, streamID)
+}
+
+func (s *snapshotCache) OnStreamRequest(streamID int64, req *discoveryv3.DiscoveryRequest) error {
+	s.mu.Lock()
+	// We could do this a little earlier than the defer, since the last half of this func is only logging
+	// but that seemed like a premature optimization.
+	defer s.mu.Unlock()
+
+	// It's possible that only the first discovery request will have a node ID set.
+	// We also need to save the node ID to the node list anyway.
+	// So check if we have a nodeID for this stream already, then set it if not.
+	if s.streamIDNodeInfo[streamID] == nil {
+		if req.Node.Id == "" {
+			return fmt.Errorf("couldn't get the node ID from the first discovery request on stream %d", streamID)
+		}
+		loggers.LoggerAPKOperator.Debugf("First discovery request on stream %d, got nodeID %s", streamID, req.Node.Id)
+		s.streamIDNodeInfo[streamID] = req.Node
+	}
+	nodeID := s.streamIDNodeInfo[streamID].Id
+	cluster := s.streamIDNodeInfo[streamID].Cluster
+
+	var nodeVersion string
+
+	var errorCode int32
+	var errorMessage string
+
+	// If no snapshot has been generated yet, we can't do anything, so don't mess with this request.
+	// go-control-plane will respond with an empty response, then send an update when a snapshot is generated.
+	if s.lastSnapshot[cluster] == nil {
+		return nil
+	}
+
+	_, err := s.GetSnapshot(nodeID)
+	if err != nil {
+		err = s.SetSnapshot(context.TODO(), nodeID, s.lastSnapshot[cluster])
+		if err != nil {
+			return err
+		}
+	}
+
+	if req.Node != nil {
+		if bv := req.Node.GetUserAgentBuildVersion(); bv != nil && bv.Version != nil {
+			nodeVersion = fmt.Sprintf("v%d.%d.%d", bv.Version.MajorNumber, bv.Version.MinorNumber, bv.Version.Patch)
+		}
+	}
+
+	loggers.LoggerAPKOperator.Debugf("Got a new request, version_info %s, response_nonce %s, nodeID %s, node_version %s", req.VersionInfo, req.ResponseNonce, nodeID, nodeVersion)
+
+	if status := req.ErrorDetail; status != nil {
+		// if Envoy rejected the last update log the details here.
+		// TODO(youngnick): Handle NACK properly
+		errorCode = status.Code
+		errorMessage = status.Message
+	}
+
+	loggers.LoggerAPKOperator.Debugf("handling v3 xDS resource request, version_info %s, response_nonce %s, nodeID %s, node_version %s, resource_names %v, type_url %s, errorCode %d, errorMessage %s",
+		req.VersionInfo, req.ResponseNonce,
+		nodeID, nodeVersion, req.ResourceNames, req.GetTypeUrl(),
+		errorCode, errorMessage)
+
+	return nil
+}
+
+func (s *snapshotCache) OnStreamResponse(_ context.Context, streamID int64, _ *discoveryv3.DiscoveryRequest, _ *discoveryv3.DiscoveryResponse) {
+	// No mutex lock required here because no writing to the cache.
+	node := s.streamIDNodeInfo[streamID]
+	if node == nil {
+		loggers.LoggerAPKOperator.Errorf("Tried to send a response to a node we haven't seen yet on stream %d", streamID)
+	} else {
+		loggers.LoggerAPKOperator.Debugf("Sending Response on stream %d to node %s", streamID, node.Id)
+	}
+}
+
+// OnDeltaStreamOpen and the other OnDeltaStream*/OnStreamDelta* functions implement
+// the callbacks for the incremental xDS versions.
+// Yes, the different ordering in the name is part of the go-control-plane interface.
+func (s *snapshotCache) OnDeltaStreamOpen(_ context.Context, streamID int64, _ string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	// Ensure that we're adding the streamID to the Node ID list.
+	s.streamIDNodeInfo[streamID] = nil
+
+	return nil
+}
+
+func (s *snapshotCache) OnDeltaStreamClosed(streamID int64, _ *corev3.Node) {
+	// TODO: something with the node?
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.streamIDNodeInfo, streamID)
+}
+
+func (s *snapshotCache) OnStreamDeltaRequest(streamID int64, req *discoveryv3.DeltaDiscoveryRequest) error {
+	s.mu.Lock()
+	// We could do this a little earlier than with a defer, since the last half of this func is logging
+	// but that seemed like a premature optimization.
+	defer s.mu.Unlock()
+
+	var nodeVersion string
+	var errorCode int32
+	var errorMessage string
+	// It's possible that only the first incremental discovery request will have a node ID set.
+	// We also need to save the node ID to the node list anyway.
+	// So check if we have a nodeID for this stream already, then set it if not.
+	node := s.streamIDNodeInfo[streamID]
+	if node == nil {
+		if req.Node.Id == "" {
+			return fmt.Errorf("couldn't get the node ID from the first incremental discovery request on stream %d", streamID)
+		}
+		loggers.LoggerAPKOperator.Debugf("First incremental discovery request on stream %d, got nodeID %s", streamID, req.Node.Id)
+		s.streamIDNodeInfo[streamID] = req.Node
+	}
+	nodeID := s.streamIDNodeInfo[streamID].Id
+	cluster := s.streamIDNodeInfo[streamID].Cluster
+
+	// If no snapshot has been written into the snapshotCache yet, we can't do anything, so don't mess with
+	// this request. go-control-plane will respond with an empty response, then send an update when a
+	// snapshot is generated.
+	if s.lastSnapshot[cluster] == nil {
+		return nil
+	}
+
+	_, err := s.GetSnapshot(nodeID)
+	if err != nil {
+		err = s.SetSnapshot(context.TODO(), nodeID, s.lastSnapshot[cluster])
+		if err != nil {
+			return err
+		}
+	}
+
+	if req.Node != nil {
+		if bv := req.Node.GetUserAgentBuildVersion(); bv != nil && bv.Version != nil {
+			nodeVersion = fmt.Sprintf("v%d.%d.%d", bv.Version.MajorNumber, bv.Version.MinorNumber, bv.Version.Patch)
+		}
+	}
+
+	loggers.LoggerAPKOperator.Debugf("Got a new request, response_nonce %s, nodeID %s, node_version %s",
+		req.ResponseNonce, nodeID, nodeVersion)
+	if status := req.ErrorDetail; status != nil {
+		// if Envoy rejected the last update log the details here.
+		// TODO(youngnick): Handle NACK properly
+		errorCode = status.Code
+		errorMessage = status.Message
+	}
+	loggers.LoggerAPKOperator.Debugf("handling v3 xDS resource request, response_nonce %s, nodeID %s, node_version %s, resource_names_subscribe %v, resource_names_unsubscribe %v, type_url %s, errorCode %d, errorMessage %s",
+		req.ResponseNonce,
+		nodeID, nodeVersion,
+		req.ResourceNamesSubscribe, req.ResourceNamesUnsubscribe,
+		req.GetTypeUrl(),
+		errorCode, errorMessage)
+
+	return nil
+}
+
+func (s *snapshotCache) OnStreamDeltaResponse(streamID int64, _ *discoveryv3.DeltaDiscoveryRequest, _ *discoveryv3.DeltaDiscoveryResponse) {
+	// No mutex lock required here because no writing to the cache.
+	node := s.streamIDNodeInfo[streamID]
+	if node == nil {
+		loggers.LoggerAPKOperator.Errorf("Tried to send a response to a node we haven't seen yet on stream %d", streamID)
+	} else {
+		loggers.LoggerAPKOperator.Debugf("Sending Incremental Response on stream %d to node %s", streamID, node.Id)
+	}
+}
+
+func (s *snapshotCache) OnFetchRequest(_ context.Context, _ *discoveryv3.DiscoveryRequest) error {
+	return nil
+}
+
+func (s *snapshotCache) OnFetchResponse(_ *discoveryv3.DiscoveryRequest, _ *discoveryv3.DiscoveryResponse) {
+}
diff --git a/adapter/internal/operator/gateway-api/xds/filters/wellknown.go b/adapter/internal/operator/gateway-api/xds/filters/wellknown.go
new file mode 100644
index 000000000..215f0769b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/xds/filters/wellknown.go
@@ -0,0 +1,64 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package filters
+
+import (
+	grpcstats "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/grpc_stats/v3"
+	grpcweb "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/grpc_web/v3"
+	httprouter "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/router/v3"
+	hcm "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/pkg/utils/protocov"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+)
+
+var (
+	GRPCWeb = &hcm.HttpFilter{
+		Name: wellknown.GRPCWeb,
+		ConfigType: &hcm.HttpFilter_TypedConfig{
+			TypedConfig: protocov.ToAny(&grpcweb.GrpcWeb{}),
+		},
+	}
+	GRPCStats = &hcm.HttpFilter{
+		Name: wellknown.HTTPGRPCStats,
+		ConfigType: &hcm.HttpFilter_TypedConfig{
+			TypedConfig: protocov.ToAny(&grpcstats.FilterConfig{
+				EmitFilterState: true,
+				PerMethodStatSpecifier: &grpcstats.FilterConfig_StatsForAllMethods{
+					StatsForAllMethods: &wrapperspb.BoolValue{Value: true},
+				},
+			}),
+		},
+	}
+)
+
+func GenerateRouterFilter(enableEnvoyHeaders bool) *hcm.HttpFilter {
+	return &hcm.HttpFilter{
+		Name: wellknown.Router,
+		ConfigType: &hcm.HttpFilter_TypedConfig{
+			TypedConfig: protocov.ToAny(&httprouter.Router{
+				SuppressEnvoyHeaders: !enableEnvoyHeaders,
+			}),
+		},
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner.go b/adapter/internal/operator/gateway-api/xds/runner/runner.go
new file mode 100644
index 000000000..ffbafca29
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner.go
@@ -0,0 +1,187 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"strconv"
+	"time"
+
+	"google.golang.org/grpc/keepalive"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/service/cluster/v3"
+	discoveryv3 "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/service/endpoint/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/service/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/service/route/v3"
+	runtimev3 "github.com/envoyproxy/go-control-plane/envoy/service/runtime/v3"
+	secretv3 "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
+	serverv3 "github.com/envoyproxy/go-control-plane/pkg/server/v3"
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/cache"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/types"
+	"github.com/wso2/apk/adapter/pkg/utils/tlsutils"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+)
+
+const (
+	// XdsServerAddress is the listening address of the xds-server.
+	XdsServerAddress = "0.0.0.0"
+	// xdsTLSCertFilename is the fully qualified path of the file containing the
+	// xDS server TLS certificate.
+	// xdsTLSCertFilename = "/home/wso2/security/keystore/adapter.crt"
+	// // xdsTLSKeyFilename is the fully qualified path of the file containing the
+	// // xDS server TLS key.
+	// xdsTLSKeyFilename = "/home/wso2/security/keystore/adapter.key"
+	// xdsTLSCaFilename is the fully qualified path of the file containing the
+	// xDS server trusted CA certificate.
+	// xdsTLSCaFilename = "/home/wso2/security/truststore/adapter.crt"
+)
+
+type Config struct {
+	Xds   *message.Xds
+	grpc  *grpc.Server
+	cache cache.SnapshotCacheWithCallbacks
+}
+
+type Runner struct {
+	Config
+}
+
+func New(cfg *Config) *Runner {
+	return &Runner{Config: *cfg}
+}
+
+func (r *Runner) Name() string {
+	return string("xds-server")
+}
+
+// Start starts the xds-server runner
+func (r *Runner) Start(ctx context.Context) (err error) {
+
+	// Set up the gRPC server and register the xDS handler.
+	// Create SnapshotCache before start subscribeAndTranslate,
+	// prevent panics in case cache is nil.
+	cfg := r.tlsConfig(tlsutils.GetKeyLocations())
+	r.grpc = grpc.NewServer(grpc.Creds(credentials.NewTLS(cfg)), grpc.KeepaliveEnforcementPolicy(keepalive.EnforcementPolicy{
+		MinTime:             15 * time.Second,
+		PermitWithoutStream: true,
+	}))
+
+	r.cache = cache.NewSnapshotCache(true)
+	registerServer(serverv3.NewServer(ctx, r.cache, r.cache), r.grpc)
+
+	// Start and listen xDS gRPC Server.
+	go r.serveXdsServer(ctx)
+
+	// Start message Subscription.
+	go r.subscribeAndTranslate(ctx)
+	loggers.LoggerAPKOperator.Info("started xds runner")
+	return
+}
+
+func (r *Runner) serveXdsServer(ctx context.Context) {
+	addr := net.JoinHostPort(XdsServerAddress, strconv.Itoa(bootstrap.DefaultXdsServerPort))
+	l, err := net.Listen("tcp", addr)
+	if err != nil {
+		loggers.LoggerAPKOperator.Error(err, "failed to listen on port", "address", bootstrap.DefaultXdsServerPort)
+		return
+	}
+
+	go func() {
+		<-ctx.Done()
+		loggers.LoggerAPKOperator.Info("grpc server shutting down")
+		// We don't use GracefulStop here because envoy
+		// has long-lived hanging xDS requests. There's no
+		// mechanism to make those pending requests fail,
+		// so we forcibly terminate the TCP sessions.
+		r.grpc.Stop()
+	}()
+
+	if err = r.grpc.Serve(l); err != nil {
+		loggers.LoggerAPKOperator.Error(err, "failed to start grpc based xds server")
+	}
+}
+
+// registerServer registers the given xDS protocol Server with the gRPC
+// runtime.
+func registerServer(srv serverv3.Server, g *grpc.Server) {
+	// register services
+	discoveryv3.RegisterAggregatedDiscoveryServiceServer(g, srv)
+	secretv3.RegisterSecretDiscoveryServiceServer(g, srv)
+	clusterv3.RegisterClusterDiscoveryServiceServer(g, srv)
+	endpointv3.RegisterEndpointDiscoveryServiceServer(g, srv)
+	listenerv3.RegisterListenerDiscoveryServiceServer(g, srv)
+	routev3.RegisterRouteDiscoveryServiceServer(g, srv)
+	runtimev3.RegisterRuntimeDiscoveryServiceServer(g, srv)
+}
+
+func (r *Runner) subscribeAndTranslate(ctx context.Context) {
+	// Subscribe to resources
+	message.HandleSubscription(message.Metadata{Runner: string("xds-server"), Message: "xds"}, r.Xds.Subscribe(ctx),
+		func(update message.Update[string, *types.ResourceVersionTable], errChan chan error) {
+			key := update.Key
+			val := update.Value
+
+			loggers.LoggerAPKOperator.Info("Received an update in xds server")
+			var err error
+			if update.Delete {
+				err = r.cache.GenerateNewSnapshot(key, nil)
+			} else if val != nil && val.XdsResources != nil {
+				if r.cache == nil {
+					loggers.LoggerAPKOperator.Error("Failed to init snapshot cache ", err)
+					errChan <- err
+				} else {
+					// Update snapshot cache
+					err = r.cache.GenerateNewSnapshot(key, val.XdsResources)
+				}
+			}
+			if err != nil {
+				loggers.LoggerAPKOperator.Error("Failed to generate a snapshot ", err)
+				errChan <- err
+			}
+		},
+	)
+
+	loggers.LoggerAPKOperator.Info("subscriber shutting down")
+}
+
+func (r *Runner) tlsConfig(cert, key, ca string) *tls.Config {
+	extCert, err := tlsutils.GetServerCertificate(cert, key)
+	if err != nil {
+		loggers.LoggerAPKOperator.Error("failed to parse CA certificate")
+		return nil
+	}
+	caCertPool := tlsutils.GetTrustedCertPool(ca)
+	return &tls.Config{
+		Certificates: []tls.Certificate{extCert},
+		ClientAuth:   tls.RequireAndVerifyClientCert,
+		ClientCAs:    caCertPool,
+		MinVersion:   tls.VersionTLS13,
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner_test.go b/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
new file mode 100644
index 000000000..3dba8c03f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
@@ -0,0 +1,201 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"net"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+)
+
+// func TestTLSConfig(t *testing.T) {
+// 	// Create trusted CA, server and client certs.
+// 	trustedCACert := certyaml.Certificate{
+// 		Subject: "cn=trusted-ca",
+// 	}
+// 	egCertBeforeRotation := certyaml.Certificate{
+// 		Subject:         "cn=eg-before-rotation",
+// 		SubjectAltNames: []string{"DNS:localhost"},
+// 		Issuer:          &trustedCACert,
+// 	}
+// 	egCertAfterRotation := certyaml.Certificate{
+// 		Subject:         "cn=eg-after-rotation",
+// 		SubjectAltNames: []string{"DNS:localhost"},
+// 		Issuer:          &trustedCACert,
+// 	}
+// 	trustedEnvoyCert := certyaml.Certificate{
+// 		Subject: "cn=trusted-envoy",
+// 		Issuer:  &trustedCACert,
+// 	}
+
+// 	// Create another CA and a client cert to test that untrusted clients are denied.
+// 	untrustedCACert := certyaml.Certificate{
+// 		Subject: "cn=untrusted-ca",
+// 	}
+// 	untrustedClientCert := certyaml.Certificate{
+// 		Subject: "cn=untrusted-client",
+// 		Issuer:  &untrustedCACert,
+// 	}
+
+// 	caCertPool := x509.NewCertPool()
+// 	ca, err := trustedCACert.X509Certificate()
+// 	require.NoError(t, err)
+// 	caCertPool.AddCert(&ca)
+
+// 	tests := map[string]struct {
+// 		serverCredentials *certyaml.Certificate
+// 		clientCredentials *certyaml.Certificate
+// 		expectError       bool
+// 	}{
+// 		"successful TLS connection established": {
+// 			serverCredentials: &egCertBeforeRotation,
+// 			clientCredentials: &trustedEnvoyCert,
+// 			expectError:       false,
+// 		},
+// 		"rotating server credentials returns new server cert": {
+// 			serverCredentials: &egCertAfterRotation,
+// 			clientCredentials: &trustedEnvoyCert,
+// 			expectError:       false,
+// 		},
+// 		"rotating server credentials again to ensure rotation can be repeated": {
+// 			serverCredentials: &egCertBeforeRotation,
+// 			clientCredentials: &trustedEnvoyCert,
+// 			expectError:       false,
+// 		},
+// 		"fail to connect with client certificate which is not signed by correct CA": {
+// 			serverCredentials: &egCertBeforeRotation,
+// 			clientCredentials: &untrustedClientCert,
+// 			expectError:       true,
+// 		},
+// 	}
+
+// 	// Create temporary directory to store certificates and key for the server.
+// 	configDir, err := os.MkdirTemp("", "eg-testdata-")
+// 	require.NoError(t, err)
+// 	defer os.RemoveAll(configDir)
+
+// 	caFile := filepath.Join(configDir, "ca.crt")
+// 	certFile := filepath.Join(configDir, "tls.crt")
+// 	keyFile := filepath.Join(configDir, "tls.key")
+
+// 	// Initial set of credentials must be written into temp directory before
+// 	// starting the tests to avoid error at server startup.
+// 	err = trustedCACert.WritePEM(caFile, keyFile)
+// 	require.NoError(t, err)
+// 	err = egCertBeforeRotation.WritePEM(certFile, keyFile)
+// 	require.NoError(t, err)
+
+// 	r := New(&Config{})
+// 	g := grpc.NewServer(grpc.Creds(credentials.NewTLS(r.tlsConfig(certFile, keyFile, caFile))))
+// 	if g == nil {
+// 		t.Error("failed to create server")
+// 	}
+
+// 	address := "localhost:8001"
+// 	l, err := net.Listen("tcp", address)
+// 	require.NoError(t, err)
+
+// 	go func() {
+// 		err := g.Serve(l)
+// 		require.NoError(t, err)
+// 	}()
+// 	defer g.GracefulStop()
+
+// 	for name, tc := range tests {
+// 		tc := tc
+// 		t.Run(name, func(t *testing.T) {
+// 			// Store certificate and key to temp dir used by serveContext.
+// 			err = tc.serverCredentials.WritePEM(certFile, keyFile)
+// 			require.NoError(t, err)
+// 			clientCert, _ := tc.clientCredentials.TLSCertificate()
+// 			receivedCert, err := tryConnect(address, clientCert, caCertPool)
+// 			gotError := err != nil
+// 			if gotError != tc.expectError {
+// 				t.Errorf("Unexpected result when connecting to the server: %s", err)
+// 			}
+// 			if err == nil {
+// 				expectedCert, _ := tc.serverCredentials.X509Certificate()
+// 				assert.Equal(t, &expectedCert, receivedCert)
+// 			}
+// 		})
+// 	}
+// }
+
+// tryConnect tries to establish TLS connection to the server.
+// If successful, return the server certificate.
+func tryConnect(address string, clientCert tls.Certificate, caCertPool *x509.CertPool) (*x509.Certificate, error) {
+	clientConfig := &tls.Config{
+		ServerName:   "localhost",
+		MinVersion:   tls.VersionTLS13,
+		Certificates: []tls.Certificate{clientCert},
+		RootCAs:      caCertPool,
+	}
+	conn, err := tls.Dial("tcp", address, clientConfig)
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
+
+	err = peekError(conn)
+	if err != nil {
+		return nil, err
+	}
+
+	return conn.ConnectionState().PeerCertificates[0], nil
+}
+
+// peekError is a workaround for TLS 1.3: due to shortened handshake, TLS alert
+// from server is received at first read from the socket. To receive alert for
+// bad certificate, this function tries to read one byte.
+// Adapted from https://golang.org/src/crypto/tls/handshake_client_test.go
+func peekError(conn net.Conn) error {
+	_ = conn.SetReadDeadline(time.Now().Add(100 * time.Millisecond))
+	_, err := conn.Read(make([]byte, 1))
+	if err != nil {
+		var netErr net.Error
+		if !errors.As(netErr, &netErr) || !netErr.Timeout() {
+			return err
+		}
+	}
+	return nil
+}
+
+func TestServeXdsServerListenFailed(t *testing.T) {
+	// Occupy the address to make listening failed
+	addr := net.JoinHostPort(XdsServerAddress, strconv.Itoa(bootstrap.DefaultXdsServerPort))
+	l, err := net.Listen("tcp", addr)
+	require.NoError(t, err)
+	defer l.Close()
+
+	r := New(&Config{})
+	// Don't crash in this function
+	r.serveXdsServer(context.Background())
+}
diff --git a/adapter/internal/operator/gateway-api/xds/utils/utils.go b/adapter/internal/operator/gateway-api/xds/utils/utils.go
new file mode 100644
index 000000000..e6f44d5c5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/xds/utils/utils.go
@@ -0,0 +1,66 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package utils
+
+import (
+	"bytes"
+
+	"github.com/envoyproxy/go-control-plane/pkg/cache/types"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+	"sigs.k8s.io/yaml"
+)
+
+func MarshalResourcesToJSON(resources []types.Resource) ([]byte, error) {
+	msgs := make([]proto.Message, 0)
+	for _, resource := range resources {
+		msgs = append(msgs, resource.(proto.Message))
+	}
+	var buffer bytes.Buffer
+	buffer.WriteByte('[')
+	for idx, msg := range msgs {
+		if idx != 0 {
+			buffer.WriteByte(',')
+		}
+		b, err := protojson.Marshal(msg)
+		if err != nil {
+			return nil, err
+		}
+		buffer.Write(b)
+	}
+	buffer.WriteByte(']')
+	return buffer.Bytes(), nil
+}
+
+// ResourcesToYAMLString converts xDS Resource types into YAML string
+func ResourcesToYAMLString(resources []types.Resource) (string, error) {
+	jsonBytes, err := MarshalResourcesToJSON(resources)
+	if err != nil {
+		return "", err
+	}
+	data, err := yaml.JSONToYAML(jsonBytes)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
diff --git a/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go b/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
new file mode 100644
index 000000000..6463a14e3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
@@ -0,0 +1,213 @@
+//go:build !ignore_autogenerated
+
+/*
+ *  Copyright (c) 2023, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package gatewayapi
+
+import (
+	"github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	corev1 "k8s.io/api/core/v1"
+	discoveryv1 "k8s.io/api/discovery/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+	"sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	if in.GatewayClass != nil {
+		in, out := &in.GatewayClass, &out.GatewayClass
+		*out = new(v1.GatewayClass)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Gateways != nil {
+		in, out := &in.Gateways, &out.Gateways
+		*out = make([]*v1.Gateway, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1.Gateway)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.HTTPRoutes != nil {
+		in, out := &in.HTTPRoutes, &out.HTTPRoutes
+		*out = make([]*v1.HTTPRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1.HTTPRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.GRPCRoutes != nil {
+		in, out := &in.GRPCRoutes, &out.GRPCRoutes
+		*out = make([]*v1alpha2.GRPCRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha2.GRPCRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.TLSRoutes != nil {
+		in, out := &in.TLSRoutes, &out.TLSRoutes
+		*out = make([]*v1alpha2.TLSRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha2.TLSRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.TCPRoutes != nil {
+		in, out := &in.TCPRoutes, &out.TCPRoutes
+		*out = make([]*v1alpha2.TCPRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha2.TCPRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.UDPRoutes != nil {
+		in, out := &in.UDPRoutes, &out.UDPRoutes
+		*out = make([]*v1alpha2.UDPRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha2.UDPRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.ReferenceGrants != nil {
+		in, out := &in.ReferenceGrants, &out.ReferenceGrants
+		*out = make([]*v1beta1.ReferenceGrant, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1beta1.ReferenceGrant)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Namespaces != nil {
+		in, out := &in.Namespaces, &out.Namespaces
+		*out = make([]*corev1.Namespace, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(corev1.Namespace)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Services != nil {
+		in, out := &in.Services, &out.Services
+		*out = make([]*corev1.Service, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(corev1.Service)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Backends != nil {
+		in, out := &in.Backends, &out.Backends
+		*out = make([]*v1alpha1.Backend, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha1.Backend)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.EndpointSlices != nil {
+		in, out := &in.EndpointSlices, &out.EndpointSlices
+		*out = make([]*discoveryv1.EndpointSlice, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(discoveryv1.EndpointSlice)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Secrets != nil {
+		in, out := &in.Secrets, &out.Secrets
+		*out = make([]*corev1.Secret, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(corev1.Secret)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.ConfigMaps != nil {
+		in, out := &in.ConfigMaps, &out.ConfigMaps
+		*out = make([]*corev1.ConfigMap, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(corev1.ConfigMap)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.ExtensionRefFilters != nil {
+		in, out := &in.ExtensionRefFilters, &out.ExtensionRefFilters
+		*out = make([]unstructured.Unstructured, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.BackendTLSPolicies != nil {
+		in, out := &in.BackendTLSPolicies, &out.BackendTLSPolicies
+		*out = make([]*v1alpha2.BackendTLSPolicy, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha2.BackendTLSPolicy)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/adapter/internal/operator/infrastructure/runner/runner.go b/adapter/internal/operator/infrastructure/runner/runner.go
new file mode 100644
index 000000000..f4f9b4010
--- /dev/null
+++ b/adapter/internal/operator/infrastructure/runner/runner.go
@@ -0,0 +1,103 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+)
+
+type Config struct {
+	InfraIR *message.InfraIR
+}
+
+type Runner struct {
+	Config
+	mgr infrastructure.Manager
+}
+
+func (r *Runner) Name() string {
+	return string("infrastructure")
+}
+
+func New(cfg *Config) *Runner {
+	return &Runner{Config: *cfg}
+}
+
+// Start starts the infrastructure runner
+func (r *Runner) Start(ctx context.Context) (err error) {
+
+	r.mgr, err = infrastructure.NewManager()
+	if err != nil {
+		loggers.LoggerAPKOperator.Error(err, "failed to create new manager")
+		return err
+	}
+	go r.subscribeToProxyInfraIR(ctx)
+
+	// Enable global ratelimit if it has been configured.
+	// if r.EnvoyGateway.RateLimit != nil {
+	// 	go r.enableRateLimitInfra(ctx)
+	// }
+
+	loggers.LoggerAPKOperator.Info("started")
+	return
+}
+
+func (r *Runner) subscribeToProxyInfraIR(ctx context.Context) {
+	// Subscribe to resources
+	message.HandleSubscription(message.Metadata{Runner: string("infrastructure"), Message: "infra-ir"}, r.InfraIR.Subscribe(ctx),
+		func(update message.Update[string, *ir.Infra], errChan chan error) {
+			loggers.LoggerAPKOperator.Info("Received an update in infrastructure provider ...")
+			val := update.Value
+
+			if update.Delete {
+				if err := r.mgr.DeleteProxyInfra(ctx, val); err != nil {
+					loggers.LoggerAPKOperator.Error(err, "failed to delete infra")
+					errChan <- err
+				}
+			} else {
+				// Manage the proxy infra.
+				if len(val.Proxy.Listeners) == 0 {
+					loggers.LoggerAPKOperator.Info("Infra IR was updated, but no listeners were found. Skipping infra creation.")
+					return
+				}
+
+				if err := r.mgr.CreateOrUpdateProxyInfra(ctx, val); err != nil {
+					loggers.LoggerAPKOperator.Error("Failed to create new infra ", err)
+					errChan <- err
+				}
+			}
+		},
+	)
+	loggers.LoggerAPKOperator.Info("infra subscriber shutting down")
+}
+
+// func (r *Runner) enableRateLimitInfra(ctx context.Context) {
+// 	if err := r.mgr.CreateOrUpdateRateLimitInfra(ctx); err != nil {
+// 		loggers.LoggerAPKOperator.Error(err, "failed to create ratelimit infra")
+// 	}
+// }
diff --git a/adapter/internal/operator/message/types.go b/adapter/internal/operator/message/types.go
new file mode 100644
index 000000000..a5e22562c
--- /dev/null
+++ b/adapter/internal/operator/message/types.go
@@ -0,0 +1,106 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package message
+
+import (
+	"github.com/telepresenceio/watchable"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	xdstypes "github.com/wso2/apk/adapter/internal/types"
+	"k8s.io/apimachinery/pkg/types"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// ProviderResources message
+type ProviderResources struct {
+	// GatewayAPIResources is a map from a GatewayClass name to
+	// a group of gateway API and other related resources.
+	GatewayAPIResources watchable.Map[string, *gatewayapi.ControllerResources]
+
+	// GatewayAPIStatuses is a group of gateway api
+	// resource statuses maps.
+	GatewayAPIStatuses
+}
+
+func (p *ProviderResources) GetResources() []*gatewayapi.Resources {
+	if p.GatewayAPIResources.Len() == 0 {
+		return nil
+	}
+
+	for _, v := range p.GatewayAPIResources.LoadAll() {
+		return *v
+	}
+
+	return nil
+}
+
+func (p *ProviderResources) GetResourcesByGatewayClass(name string) *gatewayapi.Resources {
+	for _, r := range p.GetResources() {
+		if r != nil && r.GatewayClass != nil && r.GatewayClass.Name == name {
+			return r
+		}
+	}
+
+	return nil
+}
+
+func (p *ProviderResources) GetResourcesKey() string {
+	if p.GatewayAPIResources.Len() == 0 {
+		return ""
+	}
+	for k := range p.GatewayAPIResources.LoadAll() {
+		return k
+	}
+	return ""
+}
+
+func (p *ProviderResources) Close() {
+	p.GatewayAPIResources.Close()
+	p.GatewayAPIStatuses.Close()
+}
+
+// GatewayAPIStatuses contains gateway API resources statuses
+type GatewayAPIStatuses struct {
+	GatewayStatuses   watchable.Map[types.NamespacedName, *gwapiv1.GatewayStatus]
+	HTTPRouteStatuses watchable.Map[types.NamespacedName, *gwapiv1.HTTPRouteStatus]
+}
+
+func (s *GatewayAPIStatuses) Close() {
+	s.GatewayStatuses.Close()
+	s.HTTPRouteStatuses.Close()
+}
+
+// XdsIR message
+type XdsIR struct {
+	watchable.Map[string, *ir.Xds]
+}
+
+// InfraIR message
+type InfraIR struct {
+	watchable.Map[string, *ir.Infra]
+}
+
+// Xds message
+type Xds struct {
+	watchable.Map[string, *xdstypes.ResourceVersionTable]
+}
diff --git a/adapter/internal/operator/message/watchutil.go b/adapter/internal/operator/message/watchutil.go
new file mode 100644
index 000000000..f72ed1927
--- /dev/null
+++ b/adapter/internal/operator/message/watchutil.go
@@ -0,0 +1,71 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package message
+
+import (
+	"github.com/telepresenceio/watchable"
+	"github.com/wso2/apk/adapter/internal/loggers"
+)
+
+type Update[K comparable, V any] watchable.Update[K, V]
+
+type Metadata struct {
+	Runner  string
+	Message string
+}
+
+// HandleSubscription takes a channel returned by
+// watchable.Map.Subscribe() (or .SubscribeSubset()), and calls the
+// given function for each initial value in the map, and for any
+// updates.
+//
+// This is better than simply iterating over snapshot.Updates because
+// it handles the case where the watchable.Map already contains
+// entries before .Subscribe is called.
+func HandleSubscription[K comparable, V any](
+	meta Metadata,
+	subscription <-chan watchable.Snapshot[K, V],
+	handle func(updateFunc Update[K, V], errChans chan error),
+) {
+	//TODO: find a suitable value
+	errChans := make(chan error, 10)
+	go func() {
+		for err := range errChans {
+			loggers.LoggerAPKOperator.Error(err, "observed an error")
+		}
+	}()
+
+	if snapshot, ok := <-subscription; ok {
+		for k, v := range snapshot.State {
+			handle(Update[K, V]{
+				Key:   k,
+				Value: v,
+			}, errChans)
+		}
+	}
+	for snapshot := range subscription {
+		for _, update := range snapshot.Updates {
+			handle(Update[K, V](update), errChans)
+		}
+	}
+}
diff --git a/adapter/internal/operator/message/watchutil_test.go b/adapter/internal/operator/message/watchutil_test.go
new file mode 100644
index 000000000..2206b25d4
--- /dev/null
+++ b/adapter/internal/operator/message/watchutil_test.go
@@ -0,0 +1,79 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package message_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/telepresenceio/watchable"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+)
+
+func TestHandleSubscriptionAlreadyClosed(t *testing.T) {
+	ch := make(chan watchable.Snapshot[string, any])
+	close(ch)
+
+	var calls int
+	message.HandleSubscription[string, any](
+		message.Metadata{Runner: "demo", Message: "demo"},
+		ch,
+		func(update message.Update[string, any], errChans chan error) { calls++ },
+	)
+	assert.Equal(t, 0, calls)
+}
+
+func TestHandleSubscriptionAlreadyInitialized(t *testing.T) {
+	var m watchable.Map[string, any]
+	m.Store("foo", "bar")
+
+	endCtx, end := context.WithCancel(context.Background())
+	go func() {
+		<-endCtx.Done()
+		m.Store("baz", "qux")
+		m.Delete("qux")       // no-op
+		m.Store("foo", "bar") // no-op
+		m.Delete("baz")
+		time.Sleep(100 * time.Millisecond)
+		m.Close()
+	}()
+
+	var storeCalls int
+	var deleteCalls int
+	message.HandleSubscription[string, any](
+		message.Metadata{Runner: "demo", Message: "demo"},
+		m.Subscribe(context.Background()),
+		func(update message.Update[string, any], errChans chan error) {
+			end()
+			if update.Delete {
+				deleteCalls++
+			} else {
+				storeCalls++
+			}
+		},
+	)
+	assert.Equal(t, 2, storeCalls)
+	assert.Equal(t, 1, deleteCalls)
+}
diff --git a/adapter/internal/operator/provider-resources/runner/runner.go b/adapter/internal/operator/provider-resources/runner/runner.go
new file mode 100644
index 000000000..78982e9c6
--- /dev/null
+++ b/adapter/internal/operator/provider-resources/runner/runner.go
@@ -0,0 +1,249 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+type Config struct {
+	ProviderResources *message.ProviderResources
+	XdsIR             *message.XdsIR
+	InfraIR           *message.InfraIR
+}
+
+type Runner struct {
+	Config
+}
+
+func New(cfg *Config) *Runner {
+	return &Runner{Config: *cfg}
+}
+
+func (r *Runner) Name() string {
+	return "gateway-api"
+}
+
+// Start starts the gateway-api translator runner
+func (r *Runner) Start(ctx context.Context) (err error) {
+	go r.subscribeAndTranslate(ctx)
+	return
+}
+
+func (r *Runner) subscribeAndTranslate(ctx context.Context) {
+	message.HandleSubscription(message.Metadata{Runner: "gateway-api", Message: "provider-resources"}, r.ProviderResources.GatewayAPIResources.Subscribe(ctx),
+		func(update message.Update[string, *gatewayapi.ControllerResources], errChan chan error) {
+			val := update.Value
+			loggers.LoggerAPKOperator.Info("Received an update in provider resources ...")
+			// There is only 1 key which is the controller name
+			// so when a delete is triggered, delete all IR keys
+			if update.Delete || val == nil {
+				r.deleteAllIRKeys()
+				r.deleteAllStatusKeys()
+				return
+			}
+
+			// IR keys for watchable
+			var curIRKeys, newIRKeys []string
+
+			// Get current IR keys
+			for key := range r.InfraIR.LoadAll() {
+				curIRKeys = append(curIRKeys, key)
+			}
+
+			// Get all status keys from watchable and save them in this StatusesToDelete structure.
+			// Iterating through the controller resources, any valid keys will be removed from statusesToDelete.
+			// Remaining keys will be deleted from watchable before we exit this function.
+			statusesToDelete := r.getAllStatuses()
+
+			for _, resources := range *val {
+				// Translate and publish IRs.
+				t := &gatewayapi.Translator{
+					GatewayControllerName: "wso2.com/apk-gateway-default",
+					GatewayClassName:      v1.ObjectName(resources.GatewayClass.Name),
+				}
+
+				// Translate to IR
+				result := t.Translate(resources)
+
+				// Publish the IRs.
+				// Also validate the ir before sending it.
+				for key, val := range result.InfraIR {
+					if err := val.Validate(); err != nil {
+						loggers.LoggerAPKOperator.Error(err, "unable to validate infra ir, skipped sending it")
+						errChan <- err
+					} else {
+						r.InfraIR.Store(key, val)
+						newIRKeys = append(newIRKeys, key)
+					}
+				}
+
+				for key, val := range result.XdsIR {
+					if err := val.Validate(); err != nil {
+						loggers.LoggerAPKOperator.Error(err, "unable to validate xds ir, skipped sending it")
+						errChan <- err
+					} else {
+						r.XdsIR.Store(key, val)
+					}
+				}
+
+				// Update Status
+				for _, gateway := range result.Gateways {
+					gateway := gateway
+					key := utils.NamespacedName(gateway)
+					r.ProviderResources.GatewayStatuses.Store(key, &gateway.Status)
+					delete(statusesToDelete.GatewayStatusKeys, key)
+				}
+				for _, httpRoute := range result.HTTPRoutes {
+					httpRoute := httpRoute
+					key := utils.NamespacedName(httpRoute)
+					r.ProviderResources.HTTPRouteStatuses.Store(key, &httpRoute.Status)
+					delete(statusesToDelete.HTTPRouteStatusKeys, key)
+				}
+				// 	for _, grpcRoute := range result.GRPCRoutes {
+				// 		grpcRoute := grpcRoute
+				// 		key := utils.NamespacedName(grpcRoute)
+				// 		r.ProviderResources.GRPCRouteStatuses.Store(key, &grpcRoute.Status)
+				// 		delete(statusesToDelete.GRPCRouteStatusKeys, key)
+				// 	}
+				// 	for _, tlsRoute := range result.TLSRoutes {
+				// 		tlsRoute := tlsRoute
+				// 		key := utils.NamespacedName(tlsRoute)
+				// 		r.ProviderResources.TLSRouteStatuses.Store(key, &tlsRoute.Status)
+				// 		delete(statusesToDelete.TLSRouteStatusKeys, key)
+				// 	}
+				// 	for _, tcpRoute := range result.TCPRoutes {
+				// 		tcpRoute := tcpRoute
+				// 		key := utils.NamespacedName(tcpRoute)
+				// 		r.ProviderResources.TCPRouteStatuses.Store(key, &tcpRoute.Status)
+				// 		delete(statusesToDelete.TCPRouteStatusKeys, key)
+				// 	}
+				// 	for _, udpRoute := range result.UDPRoutes {
+				// 		udpRoute := udpRoute
+				// 		key := utils.NamespacedName(udpRoute)
+				// 		r.ProviderResources.UDPRouteStatuses.Store(key, &udpRoute.Status)
+				// 		delete(statusesToDelete.UDPRouteStatusKeys, key)
+				// 	}
+
+				// 	// Skip updating status for policies with empty status
+				// 	// They may have been skipped in this translation because
+				// 	// their target is not found (not relevant)
+
+				// 	for _, backendTLSPolicy := range result.BackendTLSPolicies {
+				// 		backendTLSPolicy := backendTLSPolicy
+				// 		key := utils.NamespacedName(backendTLSPolicy)
+				// 		if !(reflect.ValueOf(backendTLSPolicy.Status).IsZero()) {
+				// 			r.ProviderResources.BackendTLSPolicyStatuses.Store(key, &backendTLSPolicy.Status)
+				// 		}
+				// 		delete(statusesToDelete.BackendTLSPolicyStatusKeys, key)
+				// 	}
+
+			}
+
+			// Delete IR keys
+			// There is a 1:1 mapping between infra and xds IR keys
+			delKeys := getIRKeysToDelete(curIRKeys, newIRKeys)
+			for _, key := range delKeys {
+				r.InfraIR.Delete(key)
+				r.XdsIR.Delete(key)
+			}
+
+			// Delete status keys
+			r.deleteStatusKeys(statusesToDelete)
+		},
+	)
+	loggers.LoggerAPKOperator.Info("shutting down")
+}
+
+type StatusesToDelete struct {
+	GatewayStatusKeys   map[types.NamespacedName]bool
+	HTTPRouteStatusKeys map[types.NamespacedName]bool
+}
+
+func (r *Runner) getAllStatuses() *StatusesToDelete {
+	// Maps storing status keys to be deleted
+	ds := &StatusesToDelete{
+		GatewayStatusKeys:   make(map[types.NamespacedName]bool),
+		HTTPRouteStatusKeys: make(map[types.NamespacedName]bool),
+	}
+
+	// Get current status keys
+	for key := range r.ProviderResources.GatewayStatuses.LoadAll() {
+		ds.GatewayStatusKeys[key] = true
+	}
+	for key := range r.ProviderResources.HTTPRouteStatuses.LoadAll() {
+		ds.HTTPRouteStatusKeys[key] = true
+	}
+
+	return ds
+}
+
+func (r *Runner) deleteStatusKeys(ds *StatusesToDelete) {
+	for key := range ds.GatewayStatusKeys {
+		r.ProviderResources.GatewayStatuses.Delete(key)
+		delete(ds.GatewayStatusKeys, key)
+	}
+	for key := range ds.HTTPRouteStatusKeys {
+		r.ProviderResources.HTTPRouteStatuses.Delete(key)
+		delete(ds.HTTPRouteStatusKeys, key)
+	}
+}
+
+// deleteAllIRKeys deletes all XdsIR and InfraIR
+func (r *Runner) deleteAllIRKeys() {
+	for key := range r.InfraIR.LoadAll() {
+		r.InfraIR.Delete(key)
+		r.XdsIR.Delete(key)
+	}
+}
+
+// deleteAllStatusKeys deletes all status keys stored by the subscriber.
+func (r *Runner) deleteAllStatusKeys() {
+	// Fields of GatewayAPIStatuses
+	for key := range r.ProviderResources.GatewayStatuses.LoadAll() {
+		r.ProviderResources.GatewayStatuses.Delete(key)
+	}
+	for key := range r.ProviderResources.HTTPRouteStatuses.LoadAll() {
+		r.ProviderResources.HTTPRouteStatuses.Delete(key)
+	}
+}
+
+// getIRKeysToDelete returns the list of IR keys to delete
+// based on the difference between the current keys and the
+// new keys parameters passed to the function.
+func getIRKeysToDelete(curKeys, newKeys []string) []string {
+	curSet := sets.NewString(curKeys...)
+	newSet := sets.NewString(newKeys...)
+
+	delSet := curSet.Difference(newSet)
+
+	return delSet.List()
+}
diff --git a/adapter/internal/operator/provider/runner/provider_runner.go b/adapter/internal/operator/provider/runner/provider_runner.go
new file mode 100644
index 000000000..d241b67e6
--- /dev/null
+++ b/adapter/internal/operator/provider/runner/provider_runner.go
@@ -0,0 +1,69 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	provider "github.com/wso2/apk/adapter/internal/operator/gateway-api/provider/kubernetes"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+type Config struct {
+	ProviderResources *message.ProviderResources
+}
+
+type Runner struct {
+	Config
+}
+
+func New(cfg *Config) *Runner {
+	return &Runner{Config: *cfg}
+}
+
+func (r *Runner) Name() string {
+	return string("provider")
+}
+
+// Start the provider runner
+func (r *Runner) Start(ctx context.Context) (err error) {
+	loggers.LoggerAPKOperator.Info("Started Runner Kubernetes operator...")
+	cfg, err := ctrl.GetConfig()
+	if err != nil {
+		return fmt.Errorf("failed to get kubeconfig: %w", err)
+	}
+	p, err := provider.New(cfg, r.ProviderResources)
+	if err != nil {
+		return fmt.Errorf("failed to create provider %s: %w", "Kubernetes", err)
+	}
+	go func() {
+		err := p.Start(ctx)
+		if err != nil {
+			loggers.LoggerAPKOperator.Error("Unable to start kubernetes operator provider", err)
+		}
+	}()
+	return nil
+}
diff --git a/adapter/internal/operator/status/conditions.go b/adapter/internal/operator/status/conditions.go
new file mode 100644
index 000000000..0ef2b69b3
--- /dev/null
+++ b/adapter/internal/operator/status/conditions.go
@@ -0,0 +1,183 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+// This file contains code derived from Contour,
+// https://github.com/projectcontour/contour
+// from the source file
+// https://github.com/projectcontour/contour/blob/main/internal/status/gatewayclassconditions.go
+// and is provided here subject to the following:
+// Copyright Project Contour Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package status
+
+import (
+	"fmt"
+	"time"
+	"unicode"
+
+	appsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+const (
+	ReasonOlderGatewayClassExists gwapiv1.GatewayClassConditionReason = "OlderGatewayClassExists"
+
+	MsgOlderGatewayClassExists   = "Invalid GatewayClass: another older GatewayClass with the same Spec.Controller exists"
+	MsgValidGatewayClass         = "Valid GatewayClass"
+	MsgGatewayClassInvalidParams = "Invalid parametersRef"
+)
+
+// computeGatewayClassAcceptedCondition computes the GatewayClass Accepted status condition.
+func computeGatewayClassAcceptedCondition(gatewayClass *gwapiv1.GatewayClass,
+	accepted bool,
+	reason, msg string) metav1.Condition {
+	switch accepted {
+	case true:
+		return metav1.Condition{
+			Type:               string(gwapiv1.GatewayClassConditionStatusAccepted),
+			Status:             metav1.ConditionTrue,
+			Reason:             reason,
+			Message:            msg,
+			ObservedGeneration: gatewayClass.Generation,
+			LastTransitionTime: metav1.NewTime(time.Now()),
+		}
+	default:
+		return metav1.Condition{
+			Type:               string(gwapiv1.GatewayClassConditionStatusAccepted),
+			Status:             metav1.ConditionFalse,
+			Reason:             reason,
+			Message:            msg,
+			ObservedGeneration: gatewayClass.Generation,
+			LastTransitionTime: metav1.NewTime(time.Now()),
+		}
+	}
+}
+
+// computeGatewayAcceptedCondition computes the Gateway Accepted status condition.
+func computeGatewayAcceptedCondition(gw *gwapiv1.Gateway, accepted bool) metav1.Condition {
+	switch accepted {
+	case true:
+		return newCondition(string(gwapiv1.GatewayReasonAccepted), metav1.ConditionTrue,
+			string(gwapiv1.GatewayReasonAccepted),
+			"The Gateway has been scheduled by Envoy Gateway", time.Now(), gw.Generation)
+	default:
+		return newCondition(string(gwapiv1.GatewayReasonAccepted), metav1.ConditionFalse,
+			string(gwapiv1.GatewayReasonAccepted),
+			"The Gateway has not been scheduled by Envoy Gateway", time.Now(), gw.Generation)
+	}
+}
+
+// computeGatewayProgrammedCondition computes the Gateway Programmed status condition.
+// Programmed condition surfaces true when the Envoy Deployment status is ready.
+func computeGatewayProgrammedCondition(gw *gwapiv1.Gateway, deployment *appsv1.Deployment) metav1.Condition {
+	if len(gw.Status.Addresses) == 0 {
+		return newCondition(string(gwapiv1.GatewayConditionProgrammed), metav1.ConditionFalse,
+			string(gwapiv1.GatewayReasonAddressNotAssigned),
+			"No addresses have been assigned to the Gateway", time.Now(), gw.Generation)
+	}
+
+	// If there are no available replicas for the Envoy Deployment, don't
+	// mark the Gateway as ready yet.
+
+	if deployment == nil || deployment.Status.AvailableReplicas == 0 {
+		return newCondition(string(gwapiv1.GatewayConditionProgrammed), metav1.ConditionFalse,
+			string(gwapiv1.GatewayReasonNoResources),
+			"Deployment replicas unavailable", time.Now(), gw.Generation)
+	}
+
+	message := fmt.Sprintf("Address assigned to the Gateway, %d/%d envoy Deployment replicas available",
+		deployment.Status.AvailableReplicas, deployment.Status.Replicas)
+	return newCondition(string(gwapiv1.GatewayConditionProgrammed), metav1.ConditionTrue,
+		string(gwapiv1.GatewayConditionProgrammed), message, time.Now(), gw.Generation)
+}
+
+// MergeConditions adds or updates matching conditions, and updates the transition
+// time if details of a condition have changed. Returns the updated condition array.
+func MergeConditions(conditions []metav1.Condition, updates ...metav1.Condition) []metav1.Condition {
+	var additions []metav1.Condition
+	for i, update := range updates {
+		add := true
+		for j, cond := range conditions {
+			if cond.Type == update.Type {
+				add = false
+				if conditionChanged(cond, update) {
+					conditions[j].Status = update.Status
+					conditions[j].Reason = update.Reason
+					conditions[j].Message = update.Message
+					conditions[j].ObservedGeneration = update.ObservedGeneration
+					conditions[j].LastTransitionTime = update.LastTransitionTime
+					break
+				}
+			}
+		}
+		if add {
+			additions = append(additions, updates[i])
+		}
+	}
+	conditions = append(conditions, additions...)
+	return conditions
+}
+
+func newCondition(t string, status metav1.ConditionStatus, reason, msg string, lt time.Time, og int64) metav1.Condition {
+	return metav1.Condition{
+		Type:               t,
+		Status:             status,
+		Reason:             reason,
+		Message:            msg,
+		LastTransitionTime: metav1.NewTime(lt),
+		ObservedGeneration: og,
+	}
+}
+
+func conditionChanged(a, b metav1.Condition) bool {
+	return (a.Status != b.Status) ||
+		(a.Reason != b.Reason) ||
+		(a.Message != b.Message) ||
+		(a.ObservedGeneration != b.ObservedGeneration)
+}
+
+// Error2ConditionMsg format the error string to a Status condition message.
+// * Convert the first letter to capital
+// * Append "." to the string if it doesn't exit
+func Error2ConditionMsg(err error) string {
+	if err == nil {
+		return ""
+	}
+
+	message := err.Error()
+	if message == "" {
+		return message
+	}
+
+	// Convert the string to a rune slice for easier manipulation
+	runes := []rune(message)
+
+	// Check if the first rune is a letter and convert it to uppercase
+	if unicode.IsLetter(runes[0]) {
+		runes[0] = unicode.ToUpper(runes[0])
+	}
+
+	// Convert the rune slice back to a string
+	return string(runes)
+}
diff --git a/adapter/internal/operator/status/gateway.go b/adapter/internal/operator/status/gateway.go
new file mode 100644
index 000000000..475cf0772
--- /dev/null
+++ b/adapter/internal/operator/status/gateway.go
@@ -0,0 +1,108 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package status
+
+import (
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// UpdateGatewayStatusAcceptedCondition updates the status condition for the provided Gateway based on the accepted state.
+func UpdateGatewayStatusAcceptedCondition(gw *gwapiv1.Gateway, accepted bool) *gwapiv1.Gateway {
+	gw.Status.Conditions = MergeConditions(gw.Status.Conditions, computeGatewayAcceptedCondition(gw, accepted))
+	return gw
+}
+
+// UpdateGatewayStatusProgrammedCondition updates the status addresses for the provided gateway
+// based on the status IP/Hostname of svc and updates the Programmed condition based on the
+// service and deployment state.
+func UpdateGatewayStatusProgrammedCondition(gw *gwapiv1.Gateway, svc *corev1.Service, deployment *appsv1.Deployment, nodeAddresses ...string) {
+	var addresses, hostnames []string
+	// Update the status addresses field.
+	if svc != nil {
+		// If the addresses is explicitly set in the Gateway spec by the user, use it
+		// to populate the Status
+		if len(gw.Spec.Addresses) > 0 {
+			// Make sure the addresses have been populated into ExternalIPs/ClusterIPs
+			// and use that value
+			if len(svc.Spec.ExternalIPs) > 0 {
+				addresses = append(addresses, svc.Spec.ExternalIPs...)
+			} else if len(svc.Spec.ClusterIPs) > 0 {
+				addresses = append(addresses, svc.Spec.ClusterIPs...)
+			}
+		} else {
+			if svc.Spec.Type == corev1.ServiceTypeLoadBalancer {
+				for i := range svc.Status.LoadBalancer.Ingress {
+					switch {
+					case len(svc.Status.LoadBalancer.Ingress[i].IP) > 0:
+						addresses = append(addresses, svc.Status.LoadBalancer.Ingress[i].IP)
+					case len(svc.Status.LoadBalancer.Ingress[i].Hostname) > 0:
+						// Remove when the following supports the hostname address type:
+						// https://github.com/kubernetes-sigs/gateway-api/blob/v0.5.0/conformance/utils/kubernetes/helpers.go#L201-L207
+						if svc.Status.LoadBalancer.Ingress[i].Hostname == "localhost" {
+							addresses = append(addresses, "0.0.0.0")
+						}
+						hostnames = append(hostnames, svc.Status.LoadBalancer.Ingress[i].Hostname)
+					}
+				}
+			}
+
+			if svc.Spec.Type == corev1.ServiceTypeClusterIP {
+				for i := range svc.Spec.ClusterIPs {
+					if svc.Spec.ClusterIPs[i] != "" {
+						addresses = append(addresses, svc.Spec.ClusterIPs[i])
+					}
+				}
+			}
+
+			if svc.Spec.Type == corev1.ServiceTypeNodePort {
+				addresses = nodeAddresses
+			}
+		}
+
+		var gwAddresses []gwapiv1.GatewayStatusAddress
+		for i := range addresses {
+			addr := gwapiv1.GatewayStatusAddress{
+				Type:  ptr.To(gwapiv1.IPAddressType),
+				Value: addresses[i],
+			}
+			gwAddresses = append(gwAddresses, addr)
+		}
+
+		for i := range hostnames {
+			addr := gwapiv1.GatewayStatusAddress{
+				Type:  ptr.To(gwapiv1.HostnameAddressType),
+				Value: hostnames[i],
+			}
+			gwAddresses = append(gwAddresses, addr)
+		}
+
+		gw.Status.Addresses = gwAddresses
+	} else {
+		gw.Status.Addresses = nil
+	}
+	// Update the programmed condition.
+	gw.Status.Conditions = MergeConditions(gw.Status.Conditions, computeGatewayProgrammedCondition(gw, deployment))
+}
diff --git a/adapter/internal/operator/status/gatewayclass.go b/adapter/internal/operator/status/gatewayclass.go
new file mode 100644
index 000000000..ca5461fb1
--- /dev/null
+++ b/adapter/internal/operator/status/gatewayclass.go
@@ -0,0 +1,42 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+// This file contains code derived from Contour,
+// https://github.com/projectcontour/contour
+// from the source file
+// https://github.com/projectcontour/contour/blob/main/internal/status/gatewayclass.go
+// and is provided here subject to the following:
+// Copyright Project Contour Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package status
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// SetGatewayClassAccepted inserts or updates the Accepted condition
+// for the provided GatewayClass.
+func SetGatewayClassAccepted(gc *gwapiv1.GatewayClass, accepted bool, reason, msg string) *gwapiv1.GatewayClass {
+	gc.Status.Conditions = MergeConditions(gc.Status.Conditions, computeGatewayClassAcceptedCondition(gc, accepted, reason, msg))
+	return gc
+}
diff --git a/adapter/internal/operator/status/status.go b/adapter/internal/operator/status/status.go
index c08b7df83..0ca1b4f17 100644
--- a/adapter/internal/operator/status/status.go
+++ b/adapter/internal/operator/status/status.go
@@ -65,7 +65,8 @@ func (updateHandler *UpdateHandler) applyUpdate(update Update) {
 	})
 
 	if err != nil {
-		loggers.LoggerAPKOperator.Errorf("Unable to update status for %s, Error : %v ", update.NamespacedName.String(), err)
+		loggers.LoggerAPKOperator.Errorf("Unable to update status for %s, Resource Kind : %+v, Error : %v ",
+			update.NamespacedName.String(), update.Resource.GetObjectKind(), err)
 	}
 }
 
diff --git a/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go b/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go
index 201685195..15146d417 100644
--- a/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go
+++ b/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go
@@ -1,5 +1,4 @@
 //go:build !ignore_autogenerated
-// +build !ignore_autogenerated
 
 /*
  *  Copyright (c) 2023, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
@@ -150,7 +149,8 @@ func (in *GQLRouteState) DeepCopyInto(out *GQLRouteState) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1alpha2.GQLRoute)
 				(*in).DeepCopyInto(*out)
 			}
@@ -165,7 +165,8 @@ func (in *GQLRouteState) DeepCopyInto(out *GQLRouteState) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1alpha1.ResolvedBackend)
 				(*in).DeepCopyInto(*out)
 			}
@@ -227,14 +228,16 @@ func (in *GatewayStateData) DeepCopyInto(out *GatewayStateData) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = make(map[string][]byte, len(*in))
 				for key, val := range *in {
 					var outVal []byte
 					if val == nil {
 						(*out)[key] = nil
 					} else {
-						in, out := &val, &outVal
+						inVal := (*in)[key]
+						in, out := &inVal, &outVal
 						*out = make([]byte, len(*in))
 						copy(*out, *in)
 					}
@@ -259,7 +262,8 @@ func (in *GatewayStateData) DeepCopyInto(out *GatewayStateData) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1alpha1.ResolvedBackend)
 				(*in).DeepCopyInto(*out)
 			}
@@ -281,7 +285,8 @@ func (in *GatewayStateData) DeepCopyInto(out *GatewayStateData) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1alpha1.RateLimitPolicy)
 				(*in).DeepCopyInto(*out)
 			}
@@ -316,7 +321,8 @@ func (in *HTTPRouteState) DeepCopyInto(out *HTTPRouteState) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1.HTTPRoute)
 				(*in).DeepCopyInto(*out)
 			}
@@ -331,7 +337,8 @@ func (in *HTTPRouteState) DeepCopyInto(out *HTTPRouteState) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1alpha1.ResolvedBackend)
 				(*in).DeepCopyInto(*out)
 			}
diff --git a/adapter/internal/types/resourceversiontable.go b/adapter/internal/types/resourceversiontable.go
new file mode 100644
index 000000000..b22a53468
--- /dev/null
+++ b/adapter/internal/types/resourceversiontable.go
@@ -0,0 +1,196 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package types
+
+import (
+	"fmt"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/cache/types"
+	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"google.golang.org/protobuf/proto"
+)
+
+// XdsResources represents all the xds resources
+type XdsResources = map[resourcev3.Type][]types.Resource
+
+// ResourceVersionTable holds all the translated xds resources
+type ResourceVersionTable struct {
+	XdsResources
+}
+
+// DeepCopyInto copies the contents into the output object
+// This was generated by controller-gen, moved from
+// zz_generated.deepcopy.go and updated to use proto.Clone
+// to deep copy the proto.Message
+func (t *ResourceVersionTable) DeepCopyInto(out *ResourceVersionTable) {
+	*out = *t
+	if t.XdsResources != nil {
+		in, out := &t.XdsResources, &out.XdsResources
+		*out = make(map[string][]types.Resource, len(*in))
+		for key, val := range *in {
+			var outVal []types.Resource
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				// Snippet was generated by controller-gen
+				//G601: Implicit memory aliasing in for loop.
+				in, out := &val, &outVal //nolint:gosec,scopelint
+				*out = make([]types.Resource, len(*in))
+				for i := range *in {
+					(*out)[i] = proto.Clone((*in)[i])
+				}
+			}
+			(*out)[key] = outVal
+		}
+	}
+}
+
+// DeepCopy generates a deep copy of the ResourceVersionTable object.
+// This was generated by controller-gen and moved over from
+// zz_generated.deepcopy.go to this file.
+func (t *ResourceVersionTable) DeepCopy() *ResourceVersionTable {
+	if t == nil {
+		return nil
+	}
+	out := new(ResourceVersionTable)
+	t.DeepCopyInto(out)
+	return out
+}
+
+// GetXdsResources retrieves the translated xds resources saved in the translator context.
+func (t *ResourceVersionTable) GetXdsResources() XdsResources {
+	return t.XdsResources
+}
+
+func (t *ResourceVersionTable) AddXdsResource(rType resourcev3.Type, xdsResource types.Resource) error {
+	// It's a sanity check to make sure the xdsResource is not nil
+	if xdsResource == nil {
+		return fmt.Errorf("xds resource is nil")
+	}
+
+	// Perform type switch to handle different types of xdsResource
+	switch rType {
+	case resourcev3.ListenerType:
+		// Handle Type specific operations
+		if resourceOfType, ok := xdsResource.(*listenerv3.Listener); ok {
+			if err := resourceOfType.ValidateAll(); err != nil {
+				return fmt.Errorf("validation failed for xds resource %+v, err: %w", xdsResource, err)
+			}
+		} else {
+			return fmt.Errorf("failed to cast xds resource %+v to Listener type", xdsResource)
+		}
+	case resourcev3.RouteType:
+		// Handle Type specific operations
+		if resourceOfType, ok := xdsResource.(*routev3.RouteConfiguration); ok {
+			if err := resourceOfType.ValidateAll(); err != nil {
+				return fmt.Errorf("validation failed for xds resource %+v, err: %w", xdsResource, err)
+			}
+		} else {
+			return fmt.Errorf("failed to cast xds resource %+v to RouteConfiguration type", xdsResource)
+		}
+
+	case resourcev3.SecretType:
+		// Handle specific operations
+		if resourceOfType, ok := xdsResource.(*tlsv3.Secret); ok {
+			if err := resourceOfType.ValidateAll(); err != nil {
+				return fmt.Errorf("validation failed for xds resource %+v, err: %w", xdsResource, err)
+			}
+		} else {
+			return fmt.Errorf("failed to cast xds resource %+v to Secret type", xdsResource)
+		}
+
+	case resourcev3.EndpointType:
+		if resourceOfType, ok := xdsResource.(*endpointv3.ClusterLoadAssignment); ok {
+			if err := resourceOfType.ValidateAll(); err != nil {
+				return fmt.Errorf("validation failed for xds resource %+v, err: %w", xdsResource, err)
+			}
+		} else {
+			return fmt.Errorf("failed to cast xds resource %+v to ClusterLoadAssignment type", xdsResource)
+		}
+
+	case resourcev3.ClusterType:
+		// Handle specific operations
+		if resourceOfType, ok := xdsResource.(*clusterv3.Cluster); ok {
+			if err := resourceOfType.ValidateAll(); err != nil {
+				return fmt.Errorf("validation failed for xds resource %+v, err: %w", xdsResource, err)
+			}
+		} else {
+			return fmt.Errorf("failed to cast xds resource %+v to Cluster type", xdsResource)
+		}
+	case resourcev3.RateLimitConfigType:
+		// Handle specific operations
+		// cfg resource from runner.go is the RateLimitConfig type from "github.com/envoyproxy/go-control-plane/ratelimit/config/ratelimit/v3", which does have validate function.
+
+		// Add more cases for other types as needed
+	default:
+		// Handle the case when the type is not recognized or supported
+	}
+
+	if t.XdsResources == nil {
+		t.XdsResources = make(XdsResources)
+	}
+	if t.XdsResources[rType] == nil {
+		t.XdsResources[rType] = make([]types.Resource, 0, 1)
+	}
+
+	t.XdsResources[rType] = append(t.XdsResources[rType], xdsResource)
+	return nil
+}
+
+// AddOrReplaceXdsResource will update an existing resource of rType according to matchFunc or add as a new resource
+// if none satisfy the match criteria. It will only update the first match it finds, regardless
+// if multiple resources satisfy the match criteria.
+func (t *ResourceVersionTable) AddOrReplaceXdsResource(rType resourcev3.Type, resource types.Resource, matchFunc func(existing types.Resource, new types.Resource) bool) error {
+	if t.XdsResources == nil || t.XdsResources[rType] == nil {
+		return t.AddXdsResource(rType, resource)
+	}
+
+	var found bool
+	for i, r := range t.XdsResources[rType] {
+		if matchFunc(r, resource) {
+			t.XdsResources[rType][i] = resource
+			found = true
+			break
+		}
+	}
+	if !found {
+		if err := t.AddXdsResource(rType, resource); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// SetResources will update an entire entry of the XdsResources for a certain type to the provided resources
+func (t *ResourceVersionTable) SetResources(rType resourcev3.Type, xdsResources []types.Resource) {
+	if t.XdsResources == nil {
+		t.XdsResources = make(XdsResources)
+	}
+
+	t.XdsResources[rType] = xdsResources
+}
diff --git a/adapter/internal/types/resourceversiontable_test.go b/adapter/internal/types/resourceversiontable_test.go
new file mode 100644
index 000000000..d734dea70
--- /dev/null
+++ b/adapter/internal/types/resourceversiontable_test.go
@@ -0,0 +1,913 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package types
+
+import (
+	"testing"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/cache/types"
+	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
+)
+
+var (
+	testListener = &listenerv3.Listener{
+		Name: "test-listener",
+	}
+	testSecret = &tlsv3.Secret{
+		Name: "test-secret",
+	}
+)
+
+func TestDeepCopy(t *testing.T) {
+	testCases := []struct {
+		name string
+		in   *ResourceVersionTable
+		out  *ResourceVersionTable
+	}{
+		{
+			name: "nil",
+			in:   nil,
+			out:  nil,
+		},
+		{
+			name: "listener",
+			in: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+				},
+			},
+			out: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+				},
+			},
+		},
+		{
+			name: "kitchen-sink",
+			in: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+					resourcev3.SecretType:   []types.Resource{testSecret},
+				},
+			},
+			out: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+					resourcev3.SecretType:   []types.Resource{testSecret},
+				},
+			},
+		},
+	}
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.out == nil {
+				require.Nil(t, tc.in.DeepCopy())
+			} else {
+				diff := cmp.Diff(tc.out, tc.in.DeepCopy(), protocmp.Transform())
+				require.Empty(t, diff)
+			}
+		})
+	}
+}
+
+func TestAddOrReplaceXdsResource(t *testing.T) {
+	testListener := &listenerv3.Listener{
+		Name: "test-listener",
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Address: "exampleservice.examplenamespace.svc.cluster.local",
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: 5000,
+					},
+					Protocol: corev3.SocketAddress_TCP,
+				},
+			},
+		},
+	}
+	updatedListener := &listenerv3.Listener{
+		Name: "test-listener",
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Address: "newsvc.newns.svc.cluster.local",
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: 8000,
+					},
+					Protocol: corev3.SocketAddress_TCP,
+				},
+			},
+		},
+	}
+	testCluster := &clusterv3.Cluster{
+		Name: "test-cluster",
+		LoadAssignment: &endpointv3.ClusterLoadAssignment{
+			ClusterName: "test-cluster",
+			Endpoints: []*endpointv3.LocalityLbEndpoints{
+				{
+					LbEndpoints: []*endpointv3.LbEndpoint{
+						{
+							HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+								Endpoint: &endpointv3.Endpoint{
+									Address: &corev3.Address{
+										Address: &corev3.Address_SocketAddress{
+											SocketAddress: &corev3.SocketAddress{
+												Address: "exampleservice.examplenamespace.svc.cluster.local",
+												PortSpecifier: &corev3.SocketAddress_PortValue{
+													PortValue: 5000,
+												},
+												Protocol: corev3.SocketAddress_TCP,
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	updatedCluster := &clusterv3.Cluster{
+		Name: "test-cluster",
+		LoadAssignment: &endpointv3.ClusterLoadAssignment{
+			ClusterName: "test-cluster",
+			Endpoints: []*endpointv3.LocalityLbEndpoints{
+				{
+					LbEndpoints: []*endpointv3.LbEndpoint{
+						{
+							HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+								Endpoint: &endpointv3.Endpoint{
+									Address: &corev3.Address{
+										Address: &corev3.Address_SocketAddress{
+											SocketAddress: &corev3.SocketAddress{
+												Address: "modified.example.svc.cluster.local",
+												PortSpecifier: &corev3.SocketAddress_PortValue{
+													PortValue: 5000,
+												},
+												Protocol: corev3.SocketAddress_TCP,
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	testEndpoint := &endpointv3.ClusterLoadAssignment{
+		ClusterName: "test-cluster",
+		Endpoints: []*endpointv3.LocalityLbEndpoints{
+			{
+				LbEndpoints: []*endpointv3.LbEndpoint{
+					{
+						HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+							Endpoint: &endpointv3.Endpoint{
+								Address: &corev3.Address{
+									Address: &corev3.Address_SocketAddress{
+										SocketAddress: &corev3.SocketAddress{
+											Address: "exampleservice.examplenamespace.svc.cluster.local",
+											PortSpecifier: &corev3.SocketAddress_PortValue{
+												PortValue: 5000,
+											},
+											Protocol: corev3.SocketAddress_TCP,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	updatedEndpoint := &endpointv3.ClusterLoadAssignment{
+		ClusterName: "test-cluster",
+		Endpoints: []*endpointv3.LocalityLbEndpoints{
+			{
+				LbEndpoints: []*endpointv3.LbEndpoint{
+					{
+						HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+							Endpoint: &endpointv3.Endpoint{
+								Address: &corev3.Address{
+									Address: &corev3.Address_SocketAddress{
+										SocketAddress: &corev3.SocketAddress{
+											Address: "modified.example.svc.cluster.local",
+											PortSpecifier: &corev3.SocketAddress_PortValue{
+												PortValue: 5000,
+											},
+											Protocol: corev3.SocketAddress_TCP,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	testRouteConfig := &routev3.RouteConfiguration{
+		Name: "test-route-config",
+		VirtualHosts: []*routev3.VirtualHost{
+			{
+				Name:    "test-virtual-host",
+				Domains: []string{"test.example.com"},
+				Routes: []*routev3.Route{
+					{
+						Match: &routev3.RouteMatch{
+							PathSpecifier: &routev3.RouteMatch_Prefix{
+								Prefix: "/",
+							},
+						},
+						Action: &routev3.Route_Route{
+							Route: &routev3.RouteAction{
+								ClusterSpecifier: &routev3.RouteAction_Cluster{
+									Cluster: "test-cluster",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	testSecret := &tlsv3.Secret{
+		Name: "example-secret",
+		Type: &tlsv3.Secret_TlsCertificate{
+			TlsCertificate: &tlsv3.TlsCertificate{
+				CertificateChain: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{
+						InlineBytes: []byte("-----BEGIN CERTIFICATE-----\n... Your certificate data ... \n-----END CERTIFICATE-----"),
+					},
+				},
+				PrivateKey: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{
+						InlineBytes: []byte("-----BEGIN PRIVATE KEY-----\n... Your private key data ... \n-----END PRIVATE KEY-----"),
+					},
+				},
+			},
+		},
+		// Add other fields for the secret as needed.
+	}
+
+	testCases := []struct {
+		name       string
+		tableIn    *ResourceVersionTable
+		typeIn     resourcev3.Type
+		resourceIn types.Resource
+		funcIn     func(existing types.Resource, new types.Resource) bool
+		tableOut   *ResourceVersionTable
+	}{
+		{
+			name: "inject-new-cluster",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: testCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{testCluster},
+				},
+			},
+		},
+		{
+			name: "replace-cluster",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{testCluster},
+				},
+			},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: updatedCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{updatedCluster},
+				},
+			},
+		},
+		{
+			name: "inject-new-endpoint",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.EndpointType,
+			resourceIn: testEndpoint,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldEndpoint := existing.(*endpointv3.ClusterLoadAssignment)
+				newEndpoint := new.(*endpointv3.ClusterLoadAssignment)
+				if newEndpoint == nil || oldEndpoint == nil {
+					return false
+				}
+				if oldEndpoint.ClusterName == newEndpoint.ClusterName {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{testEndpoint},
+				},
+			},
+		},
+		{
+			name: "replace-endpoint",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{testEndpoint},
+				},
+			},
+			typeIn:     resourcev3.EndpointType,
+			resourceIn: updatedEndpoint,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldEndpoint := existing.(*endpointv3.ClusterLoadAssignment)
+				newEndpoint := new.(*endpointv3.ClusterLoadAssignment)
+				if newEndpoint == nil || oldEndpoint == nil {
+					return false
+				}
+				if oldEndpoint.ClusterName == newEndpoint.ClusterName {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{updatedEndpoint},
+				},
+			},
+		},
+		{
+			name: "inject-new-listener",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ListenerType,
+			resourceIn: testListener,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+				},
+			},
+		},
+		{
+			name: "replace-listener",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+				},
+			},
+			typeIn:     resourcev3.ListenerType,
+			resourceIn: updatedListener,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{updatedListener},
+				},
+			},
+		},
+		{
+			name: "inject-nil-resourcetype",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{},
+			},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: testCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{testCluster},
+				},
+			},
+		},
+		{
+			name:       "inject-nil resources",
+			tableIn:    &ResourceVersionTable{},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: testCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{testCluster},
+				},
+			},
+		},
+		{
+			name: "inject-route-config",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.RouteType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.RouteType,
+			resourceIn: testRouteConfig,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.RouteType: []types.Resource{testRouteConfig},
+				},
+			},
+		},
+		{
+			name: "new-secret",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.SecretType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.SecretType,
+			resourceIn: testSecret,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.SecretType: []types.Resource{testSecret},
+				},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.tableIn.AddOrReplaceXdsResource(tc.typeIn, tc.resourceIn, tc.funcIn)
+			require.NoError(t, err)
+			diff := cmp.Diff(tc.tableOut, tc.tableIn.DeepCopy(), protocmp.Transform())
+			require.Empty(t, diff)
+		})
+	}
+}
+
+func TestInvalidAddXdsResource(t *testing.T) {
+	invalidListener := &listenerv3.Listener{
+		Name: "invalid-listener",
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Address: "",
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: 5000,
+					},
+					Protocol: corev3.SocketAddress_TCP,
+				},
+			},
+		},
+	}
+	invalidRouteConfig := &routev3.RouteConfiguration{
+		Name: "test-route-config",
+		VirtualHosts: []*routev3.VirtualHost{
+			{
+				Name:    "", // missing name
+				Domains: []string{"test.example.com"},
+				Routes: []*routev3.Route{
+					{
+						Match: &routev3.RouteMatch{
+							PathSpecifier: &routev3.RouteMatch_Prefix{
+								Prefix: "/",
+							},
+						},
+						Action: &routev3.Route_Route{
+							Route: &routev3.RouteAction{
+								ClusterSpecifier: &routev3.RouteAction_Cluster{
+									Cluster: "test-cluster",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	invalidCluster := &clusterv3.Cluster{
+		Name: "test-cluster",
+		LoadAssignment: &endpointv3.ClusterLoadAssignment{
+			ClusterName: "test-cluster",
+			Endpoints: []*endpointv3.LocalityLbEndpoints{
+				{
+					LbEndpoints: []*endpointv3.LbEndpoint{
+						{
+							HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+								Endpoint: &endpointv3.Endpoint{
+									Address: &corev3.Address{
+										Address: &corev3.Address_SocketAddress{
+											SocketAddress: &corev3.SocketAddress{
+												Address: "",
+												PortSpecifier: &corev3.SocketAddress_PortValue{
+													PortValue: 5000,
+												},
+												Protocol: corev3.SocketAddress_TCP,
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	invalidEndpoint := &endpointv3.ClusterLoadAssignment{
+		ClusterName: "test-cluster",
+		Endpoints: []*endpointv3.LocalityLbEndpoints{
+			{
+				LbEndpoints: []*endpointv3.LbEndpoint{
+					{
+						HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+							Endpoint: &endpointv3.Endpoint{
+								Address: &corev3.Address{
+									Address: &corev3.Address_SocketAddress{
+										SocketAddress: &corev3.SocketAddress{
+											Address: "",
+											PortSpecifier: &corev3.SocketAddress_PortValue{
+												PortValue: 5000,
+											},
+											Protocol: corev3.SocketAddress_TCP,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	invalidSecret := &tlsv3.Secret{
+		Name: "=*&",
+		Type: &tlsv3.Secret_TlsCertificate{
+			TlsCertificate: &tlsv3.TlsCertificate{
+				CertificateChain: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{
+						InlineBytes: []byte("-----BEGIN CERTIFICATE-----\n... Your certificate data ... \n-----END CERTIFICATE-----"),
+					},
+				},
+				PrivateKey: &corev3.DataSource{},
+			},
+		},
+		// Add other fields for the secret as needed.
+	}
+
+	testCases := []struct {
+		name       string
+		tableIn    *ResourceVersionTable
+		typeIn     resourcev3.Type
+		resourceIn types.Resource
+		funcIn     func(existing types.Resource, new types.Resource) bool
+		tableOut   *ResourceVersionTable
+	}{
+		{
+			name: "inject-invalid-listener",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ListenerType,
+			resourceIn: invalidListener,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+				},
+			},
+		},
+		{
+			name: "inject-invalid-route-config",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.RouteType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.RouteType,
+			resourceIn: invalidRouteConfig,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "inject-invalid-cluster",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: invalidCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "cast-cluster-type",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: invalidListener,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "cast-listener-type",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ListenerType,
+			resourceIn: invalidCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "cast-route-config-type",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.RouteType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.RouteType,
+			resourceIn: invalidCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "cast-secret-type",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.SecretType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.SecretType,
+			resourceIn: invalidRouteConfig,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "invalid-secret",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.SecretType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.SecretType,
+			resourceIn: invalidSecret,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "inject-invalid-endpoint",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.EndpointType,
+			resourceIn: invalidEndpoint,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldEndpoint := existing.(*endpointv3.ClusterLoadAssignment)
+				newEndpoint := new.(*endpointv3.ClusterLoadAssignment)
+				if newEndpoint == nil || oldEndpoint == nil {
+					return false
+				}
+				if oldEndpoint.ClusterName == newEndpoint.ClusterName {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "cast-endpoint-type",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.EndpointType,
+			resourceIn: invalidListener,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldEndpoint := existing.(*endpointv3.ClusterLoadAssignment)
+				newEndpoint := new.(*endpointv3.ClusterLoadAssignment)
+				if newEndpoint == nil || oldEndpoint == nil {
+					return false
+				}
+				if oldEndpoint.ClusterName == newEndpoint.ClusterName {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+	}
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.tableIn.AddOrReplaceXdsResource(tc.typeIn, tc.resourceIn, tc.funcIn)
+			require.Error(t, err)
+		})
+	}
+}
diff --git a/adapter/pkg/utils/file/file.go b/adapter/pkg/utils/file/file.go
new file mode 100644
index 000000000..51740db97
--- /dev/null
+++ b/adapter/pkg/utils/file/file.go
@@ -0,0 +1,44 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package file
+
+import (
+	"bufio"
+	"os"
+)
+
+func Write(data string, filepath string) error {
+	file, err := os.OpenFile(filepath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0755)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	write := bufio.NewWriter(file)
+	_, err = write.WriteString(data)
+	if err != nil {
+		return err
+	}
+	write.Flush()
+
+	return nil
+}
diff --git a/adapter/pkg/utils/misc/misc.go b/adapter/pkg/utils/misc/misc.go
new file mode 100644
index 000000000..f4080c5f0
--- /dev/null
+++ b/adapter/pkg/utils/misc/misc.go
@@ -0,0 +1,73 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package utils
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"hash/fnv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// NamespacedName creates and returns object's NamespacedName.
+func NamespacedName(obj client.Object) types.NamespacedName {
+	return types.NamespacedName{
+		Namespace: obj.GetNamespace(),
+		Name:      obj.GetName(),
+	}
+}
+
+// GetHashedName returns a partially hashed name for the string including up to the given length of the original name characters before the hash.
+// Input `nsName` should be formatted as `{Namespace}/{ResourceName}`.
+func GetHashedName(nsName string, length int) string {
+	hashedName := Digest256(nsName)
+	// replace `/` with `-` to create a valid K8s resource name
+	resourceName := strings.ReplaceAll(nsName, "/", "-")
+	if length > 0 && len(resourceName) > length {
+		// resource name needs to be trimmed, as container port name must not contain consecutive hyphens
+		trimmedName := strings.TrimSuffix(resourceName[0:length], "-")
+		return fmt.Sprintf("%s-%s", trimmedName, hashedName[0:8])
+	}
+	// Ideally we should use 32-bit hash instead of 64-bit hash and return the first 8 characters of the hash.
+	// However, we are using 64-bit hash to maintain backward compatibility.
+	return fmt.Sprintf("%s-%s", resourceName, hashedName[0:8])
+}
+
+// Digest256 returns a sha256 hash of the input string.
+// The hash is represented as a hexadecimal string of length 64.
+func Digest256(str string) string {
+	h := sha256.New() // Using sha256 instead of sha1 due to Blocklisted import crypto/sha1: weak cryptographic primitive (gosec)
+	h.Write([]byte(str))
+	return strings.ToLower(fmt.Sprintf("%x", h.Sum(nil)))
+}
+
+// Digest32 returns a 32-bit hash of the input string.
+// The hash is represented as a hexadecimal string of length 8.
+func Digest32(str string) string {
+	h := fnv.New32a()
+	_, _ = h.Write([]byte(str))
+	return fmt.Sprintf("%x", h.Sum32())
+}
diff --git a/adapter/pkg/utils/misc/misc_test.go b/adapter/pkg/utils/misc/misc_test.go
new file mode 100644
index 000000000..e6cf51a30
--- /dev/null
+++ b/adapter/pkg/utils/misc/misc_test.go
@@ -0,0 +1,50 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package utils
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetHashedName(t *testing.T) {
+	testCases := []struct {
+		name     string
+		nsName   string
+		length   int
+		expected string
+	}{
+		{"test default name", "http", 6, "http-e0603c49"},
+		{"test removing trailing slash", "namespace/name", 10, "namespace-18a6500f"},
+		{"test removing trailing hyphen", "apk/eg/http", 6, "apk-eg-9df93c35"},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			result := GetHashedName(tc.nsName, tc.length)
+			require.Equal(t, tc.expected, result, "Result does not match expected string")
+		})
+	}
+}
diff --git a/adapter/pkg/utils/protocov/protocov.go b/adapter/pkg/utils/protocov/protocov.go
new file mode 100644
index 000000000..6040be9e9
--- /dev/null
+++ b/adapter/pkg/utils/protocov/protocov.go
@@ -0,0 +1,55 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package protocov
+
+import (
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+const (
+	APIPrefix = "type.googleapis.com/"
+)
+
+var (
+	marshalOpts = proto.MarshalOptions{}
+)
+
+func ToAnyWithError(msg proto.Message) (*anypb.Any, error) {
+	b, err := marshalOpts.Marshal(msg)
+	if err != nil {
+		return nil, err
+	}
+	return &anypb.Any{
+		TypeUrl: APIPrefix + string(msg.ProtoReflect().Descriptor().FullName()),
+		Value:   b,
+	}, nil
+}
+
+func ToAny(msg proto.Message) *anypb.Any {
+	res, err := ToAnyWithError(msg)
+	if err != nil {
+		return nil
+	}
+	return res
+}
diff --git a/adapter/pkg/utils/regex/regex.go b/adapter/pkg/utils/regex/regex.go
new file mode 100644
index 000000000..5bd9d9577
--- /dev/null
+++ b/adapter/pkg/utils/regex/regex.go
@@ -0,0 +1,36 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package regex
+
+import (
+	"fmt"
+	"regexp"
+)
+
+// Validate validates a regex string.
+func Validate(regex string) error {
+	if _, err := regexp.Compile(regex); err != nil {
+		return fmt.Errorf("regex %q is invalid: %w", regex, err)
+	}
+	return nil
+}
diff --git a/adapter/pkg/utils/regex/regex_test.go b/adapter/pkg/utils/regex/regex_test.go
new file mode 100644
index 000000000..129ac7254
--- /dev/null
+++ b/adapter/pkg/utils/regex/regex_test.go
@@ -0,0 +1,51 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package regex
+
+import "testing"
+
+func TestValidate(t *testing.T) {
+	tests := []struct {
+		name    string
+		regex   string
+		wantErr bool
+	}{
+		{
+			name:    "Valid regex",
+			regex:   "^[a-z0-9-]+$",
+			wantErr: false,
+		},
+		{
+			name:    "Invalid regex",
+			regex:   "^[a-z0-9-++$",
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if err := Validate(tt.regex); (err != nil) != tt.wantErr {
+				t.Errorf("Validate() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
diff --git a/adapter/pkg/utils/stringutils/string_utils.go b/adapter/pkg/utils/stringutils/string_utils.go
index 829f02bdd..b8394f0db 100644
--- a/adapter/pkg/utils/stringutils/string_utils.go
+++ b/adapter/pkg/utils/stringutils/string_utils.go
@@ -67,3 +67,16 @@ func ToStringArray[T any](array []T) []string {
 	}
 	return vHosts
 }
+
+// RemoveString returns a newly created []string that contains all items from slice that
+// are not equal to s.
+func RemoveString(slice []string, s string) []string {
+	var newSlice []string
+	for _, item := range slice {
+		if item == s {
+			continue
+		}
+		newSlice = append(newSlice, item)
+	}
+	return newSlice
+}
diff --git a/adapter/pkg/utils/stringutils/string_utils_test.go b/adapter/pkg/utils/stringutils/string_utils_test.go
index ae6713257..7fa736841 100644
--- a/adapter/pkg/utils/stringutils/string_utils_test.go
+++ b/adapter/pkg/utils/stringutils/string_utils_test.go
@@ -17,6 +17,7 @@
 package stringutils
 
 import (
+	"reflect"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -95,3 +96,42 @@ func TestMaskString(t *testing.T) {
 		assert.Equal(t, item.output, result, item.message, i)
 	}
 }
+
+func TestRemoveString(t *testing.T) {
+	tests := []struct {
+		testName string
+		input    []string
+		remove   string
+		want     []string
+	}{
+		{
+			testName: "Nil input slice",
+			input:    nil,
+			remove:   "",
+			want:     nil,
+		},
+		{
+			testName: "Remove a string from input slice",
+			input:    []string{"a", "ab", "cdef"},
+			remove:   "ab",
+			want:     []string{"a", "cdef"},
+		},
+		{
+			testName: "Slice doesn't contain the string",
+			input:    []string{"a", "ab", "cdef"},
+			remove:   "NotPresentInSlice",
+			want:     []string{"a", "ab", "cdef"},
+		},
+		{
+			testName: "All strings removed, result is nil",
+			input:    []string{"a"},
+			remove:   "a",
+			want:     nil,
+		},
+	}
+	for _, tt := range tests {
+		if got := RemoveString(tt.input, tt.remove); !reflect.DeepEqual(got, tt.want) {
+			t.Errorf("%v: RemoveString(%v, %q) = %v WANT %v", tt.testName, tt.input, tt.remove, got, tt.want)
+		}
+	}
+}
diff --git a/adapter/revive.toml b/adapter/revive.toml
index 0024ff213..80be43d1f 100644
--- a/adapter/revive.toml
+++ b/adapter/revive.toml
@@ -12,7 +12,7 @@ exclude = [ "internal/operator/controllers/cp/suite_test.go","internal/operator/
 [rule.error-return]
 [rule.error-strings]
 [rule.error-naming]
-[rule.exported]
+# [rule.exported]
 [rule.if-return]
 [rule.increment-decrement]
 [rule.var-naming]
diff --git a/gateway/enforcer/Dockerfile b/gateway/enforcer/Dockerfile
index 62ed13dfb..f581502c9 100644
--- a/gateway/enforcer/Dockerfile
+++ b/gateway/enforcer/Dockerfile
@@ -80,7 +80,7 @@ ENV ENFORCER_PUBLIC_CERT_PATH=/home/wso2/security/keystore/mg.pem
 ENV TRUSTED_CA_CERTS_PATH=/home/wso2/security/truststore
 ENV ADAPTER_HOST_NAME=adapter
 ENV ADAPTER_HOST=adapter
-ENV ADAPTER_XDS_PORT=18000
+ENV ADAPTER_XDS_PORT=18001
 ENV COMMON_CONTROLLER_HOST_NAME=common-controller
 ENV COMMON_CONTROLLER_HOST=common-controller
 ENV COMMON_CONTROLLER_XDS_PORT=18002
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/EnvVarConfig.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/EnvVarConfig.java
index a3b31bce7..e9c484dbc 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/EnvVarConfig.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/EnvVarConfig.java
@@ -68,7 +68,7 @@ public class EnvVarConfig {
     private static final String DEFAULT_ENFORCER_PUBLIC_CERT_PATH = "/home/wso2/security/keystore/mg.pem";
     private static final String DEFAULT_ENFORCER_REGION_ID = "UNKNOWN";
     private static final String DEFAULT_ADAPTER_HOST = "adapter";
-    private static final String DEFAULT_ADAPTER_XDS_PORT = "18000";
+    private static final String DEFAULT_ADAPTER_XDS_PORT = "18001";
     private static final String DEFAULT_COMMON_CONTROLLER_HOST = "common-controller";
     private static final String DEFAULT_COMMON_CONTROLLER_XDS_PORT = "18002";
     private static final String DEFAULT_COMMON_CONTROLLER_REST_PORT = "18003";
diff --git a/helm-charts/Chart.lock b/helm-charts/Chart.lock
index ffcc39971..9ce49a7eb 100644
--- a/helm-charts/Chart.lock
+++ b/helm-charts/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
   version: 17.8.0
 - name: cert-manager
   repository: https://charts.jetstack.io
-  version: v1.10.1
-digest: sha256:0991f0f8b1c4652afcde362a3359f514796b41ac6f43039712fe67df616e5eca
-generated: "2023-03-13T18:09:21.400318+05:30"
+  version: v1.10.2
+digest: sha256:c73e2790cdd6cef996f40aecb00224e74e8aae146a7d1c4afb528720b404f76c
+generated: "2024-06-13T16:05:27.648453+05:30"
diff --git a/helm-charts/Chart.yaml b/helm-charts/Chart.yaml
index 1a794cac6..1e7fb5957 100644
--- a/helm-charts/Chart.yaml
+++ b/helm-charts/Chart.yaml
@@ -14,6 +14,6 @@ dependencies:
     repository: "https://charts.bitnami.com/bitnami"
     condition: redis.enabled
   - name: cert-manager
-    version: "v1.10.1"
+    version: "v1.10.2"
     repository: "https://charts.jetstack.io"
     condition: certmanager.enabled
diff --git a/helm-charts/templates/cert-manager/certificates/envoy-certificate.yaml b/helm-charts/templates/cert-manager/certificates/envoy-certificate.yaml
new file mode 100644
index 000000000..b154b3eee
--- /dev/null
+++ b/helm-charts/templates/cert-manager/certificates/envoy-certificate.yaml
@@ -0,0 +1,43 @@
+# Copyright (c) 2022, WSO2 LLC. (https://www.wso2.com) All Rights Reserved.
+#
+# WSO2 LLC. licenses this file to you under the Apache License,
+# Version 2.0 (the "License"); you may not use this file except
+# in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# The following manifests contain a self-signed issuer CR and a certificate CR.
+# More document can be found at https://docs.cert-manager.io
+
+{{- if .Values.wso2.apk.dp.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: envoy-cert
+  namespace: {{ .Release.Namespace }}
+spec:
+  commonName: envoy-gateway
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS8
+    size: 2048
+  dnsNames:
+  - \*.{{ .Release.Namespace }}.svc
+  - \*.{{ .Release.Namespace }}.svc.cluster.local
+  issuerRef:
+    kind: {{ .Values.certmanager.issuerKind | default "ClusterIssuer" }}
+    {{ if .Values.certmanager.servers -}}
+    name: {{  .Values.certmanager.servers.issuerName | default "selfsigned-issuer" }}
+    {{- else -}}
+    name: {{ template "apk-helm.resource.prefix" . }}-selfsigned-issuer
+    {{- end }}
+  secretName: envoy-cert
+{{- end -}}
diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
index 9167c587d..3416b7cdd 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
@@ -88,7 +88,7 @@ spec:
             {{- else }}
               subPath: ca.crt
             {{- end }}
-            - name: router-truststore-secret-volume
+            - name: envoy-truststore-secret-volume
               mountPath: /home/wso2/security/truststore/router.crt
             {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
               subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certFilename | default "tls.crt" }}
@@ -158,13 +158,9 @@ spec:
         #   secret:
         #     secretName: {{ template "apk-helm.resource.prefix" . }}-webhook-server-cert
         #     defaultMode: 420
-        - name: router-truststore-secret-volume
+        - name: envoy-truststore-secret-volume
           secret: 
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
-            secretName: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.secretName | default (printf "%s-gateway-server-cert" (include "apk-helm.resource.prefix" .)) }}
-          {{- else }}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-gateway-server-cert
-          {{- end }}
+            secretName: envoy-cert
         - name: enforcer-truststore-secret-volume
           secret: 
             {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
index 9d1d9bde9..abecda2fa 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
@@ -38,7 +38,7 @@ data:
     # limitations under the License.
     # -----------------------------------------------------------------------
 
-    ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18000}"
+    ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18001}"
     grpc_health_probe -addr "127.0.0.1:${ADAPTER_XDS_PORT}" \
         -tls \
         -tls-ca-cert "${ADAPTER_PUBLIC_CERT_PATH}" \
diff --git a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-autoscaller.yaml b/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-autoscaller.yaml
deleted file mode 100644
index b9a5a8c59..000000000
--- a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-autoscaller.yaml
+++ /dev/null
@@ -1,50 +0,0 @@
-# --------------------------------------------------------------------
-# Copyright (c) 2022, WSO2 LLC. (http://wso2.com) All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-# -----------------------------------------------------------------------
-
-{{- if .Values.wso2.apk.dp.enabled }}
-{{- if and .Values.wso2.apk.dp.gateway.autoscaling .Values.wso2.apk.dp.gateway.autoscaling.enabled -}}
-
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ template "apk-helm.resource.prefix" . }}-gateway-runtime-autoscaller
-  namespace: {{ .Release.Namespace }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: {{ template "apk-helm.resource.prefix" . }}-gateway-runtime-deployment
-  minReplicas: {{ .Values.wso2.apk.dp.gateway.autoscaling.minReplicas }}
-  maxReplicas: {{ .Values.wso2.apk.dp.gateway.autoscaling.maxReplicas }}
-  metrics:
-    {{- if .Values.wso2.apk.dp.gateway.autoscaling.targetMemory }}
-    - type: Resource
-      resource:
-        name: memory
-        target:
-          type: Utilization
-          averageUtilization: {{ .Values.wso2.apk.dp.gateway.autoscaling.targetMemory }}
-    {{- end }}
-    {{- if .Values.wso2.apk.dp.gateway.autoscaling.targetCPU }}
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: {{ .Values.wso2.apk.dp.gateway.autoscaling.targetCPU }}
-    {{- end }}
-{{- end }}
-{{- end}}
\ No newline at end of file
diff --git a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-deployment.yaml b/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-deployment.yaml
deleted file mode 100644
index 3d6fc6062..000000000
--- a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-deployment.yaml
+++ /dev/null
@@ -1,476 +0,0 @@
-# Copyright (c) 2022, WSO2 LLC. (https://www.wso2.com) All Rights Reserved.
-#
-# WSO2 LLC. licenses this file to you under the Apache License,
-# Version 2.0 (the "License"); you may not use this file except
-# in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-{{- if .Values.wso2.apk.dp.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ template "apk-helm.resource.prefix" . }}-gateway-runtime-deployment
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.replicas }}
-  strategy:
-    type: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.strategy }}
-  selector:
-    matchLabels:
-{{ include "apk-helm.pod.selectorLabels" (dict "root" . "app" "gateway" ) | indent 6}}
-  template:
-    metadata:
-      labels:
-{{ include "apk-helm.pod.selectorLabels" (dict "root" . "app" "gateway" ) | indent 8}}
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/data-plane/gateway-components/log-conf.yaml") . | sha256sum }}
-    spec:
-      affinity: {{- include "apk-helm.deployment.affinity" ( dict "value" .Values.wso2.apk.dp.gatewayRuntime.deployment.affinity "app" "gateway-runtime" "context" $) | nindent 8 }}
-      {{- if .Values.wso2.apk.dp.gatewayRuntime.deployment.nodeSelector }}
-      nodeSelector: {{- include "apk-helm.deployment.nodeSelector" ( dict "value" .Values.wso2.apk.dp.gatewayRuntime.deployment.nodeSelector "context" $) | nindent 8 }}
-      {{- end }}
-      automountServiceAccountToken: false
-      containers:
-        - name: enforcer
-          image: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.image }}
-          imagePullPolicy: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.imagePullPolicy }}
-          ports:
-            - containerPort: 8081
-              protocol: "TCP"
-            - containerPort: 9001
-              protocol: "TCP"
-            - containerPort: 5006	
-              protocol: "TCP"
-            - containerPort: 8084
-              protocol: "TCP"
-            - containerPort: 9092
-              protocol: "TCP"
-            - containerPort: 18002
-              protocol: "TCP"
-            {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled}}
-            - containerPort: 18006
-              protocol: "TCP"
-            {{- end }}
-{{ include "apk-helm.deployment.resources" .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.resources | indent 10 }}
-{{ include "apk-helm.deployment.env" .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.env | indent 10 }}
-            - name: ADAPTER_HOST_NAME
-              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
-            - name: ADAPTER_HOST
-              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
-            - name: COMMON_CONTROLLER_HOST_NAME
-              value: {{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc
-            - name: COMMON_CONTROLLER_HOST
-              value: {{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc
-            - name: ENFORCER_PRIVATE_KEY_PATH
-              value: /home/wso2/security/keystore/enforcer.key  
-            - name: ENFORCER_PUBLIC_CERT_PATH
-              value: /home/wso2/security/keystore/enforcer.crt
-            - name: ENFORCER_SERVER_NAME
-              value: {{ template "apk-helm.resource.prefix" . }}-enforcer-service.{{ .Release.Namespace }}.svc
-            - name: TRUSTED_CA_CERTS_PATH
-              value: "/home/wso2/security/truststore"
-            - name: ADAPTER_XDS_PORT
-              value : "18000"
-            - name: COMMON_CONTROLLER_XDS_PORT
-              value : "18002"
-            - name: COMMON_CONTROLLER_REST_PORT
-              value : "18003"
-            - name: ENFORCER_LABEL
-              value : {{ .Values.wso2.apk.dp.gateway.name | default "wso2-apk-default" }}
-            - name: ENFORCER_REGION
-              value: UNKNOWN
-            - name: XDS_MAX_MSG_SIZE
-              value: "4194304"
-            - name: XDS_MAX_RETRIES 
-              value: "3"
-            - name: enforcer_admin_pwd
-              value: admin
-            - name: JAVA_OPTS
-            {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled }}
-              value: -Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2 -Dapk.jmx.metrics.enabled=true -javaagent:/home/wso2/lib/jmx_prometheus_javaagent-0.20.0.jar=18006:/tmp/metrics/prometheus-jmx-config-enforcer.yml
-            {{- else }}
-              value: -Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2
-            {{- end }}
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.analytics .Values.wso2.apk.dp.gatewayRuntime.analytics.publishers }}
-            {{- $defaultPublisherSecretName := "" }}
-            {{- $moesifPublisherSecretName := "" }}
-            {{- range .Values.wso2.apk.dp.gatewayRuntime.analytics.publishers }}
-              {{- if eq .type "default" }}
-                {{- $defaultPublisherSecretName = .secretName }}
-              {{- end }}
-              {{- if eq .type "moesif" }}
-                {{- $moesifPublisherSecretName = .secretName }}
-              {{- end }}
-            {{- end }}
-            {{- if $defaultPublisherSecretName }}
-            - name: CHOREO_ANALYTICS_AUTH_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $defaultPublisherSecretName }}
-                  key: "authToken"
-            - name: CHOREO_ANALYTICS_AUTH_URL
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $defaultPublisherSecretName }}
-                  key: "authURL"
-            {{- end }}
-            {{- if $moesifPublisherSecretName }}
-            - name: MOESIF_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $moesifPublisherSecretName }}
-                  key: "moesifToken"
-            {{- end }}
-            {{- end }}
-            {{- if .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis }}
-            - name: REDIS_USERNAME
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.username | default "default" }}
-            - name: REDIS_PASSWORD
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.password | default "" }}
-            - name: REDIS_HOST
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.host | default "redis-master" }}
-            - name: REDIS_PORT
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.port | default "6379" }}
-            - name: IS_REDIS_TLS_ENABLED
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.tlsEnabled | default "false" }}
-            - name: REDIS_REVOKED_TOKENS_CHANNEL
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.channelName | default "wso2-apk-revoked-tokens-channel" }}
-            - name: REDIS_KEY_FILE
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.userKeyPath | default "/home/wso2/security/redis/redis.key" }}
-            - name: REDIS_CERT_FILE
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.userCertPath | default "/home/wso2/security/redis/redis.crt" }}
-            - name: REDIS_CA_CERT_FILE
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.redisCaCertPath | default "/home/wso2/security/redis/redis-ca.key" }}
-            - name: REVOKED_TOKEN_CLEANUP_INTERVAL
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.tokenCleanupInterval | default "3600" }}
-            {{- else }}
-            - name: REDIS_USERNAME
-              value: "default"
-            - name: REDIS_PASSWORD
-              value: ""
-            - name: REDIS_HOST
-              value: "redis-master"
-            - name: REDIS_PORT
-              value: "6379"
-            - name: IS_REDIS_TLS_ENABLED
-              value: "false"
-            - name: REDIS_REVOKED_TOKENS_CHANNEL
-              value: "wso2-apk-revoked-tokens-channel"
-            - name: REDIS_KEY_FILE
-              value: "/home/wso2/security/redis/redis.key"
-            - name: REDIS_CERT_FILE
-              value: "/home/wso2/security/redis/redis.crt"
-            - name: REDIS_CA_CERT_FILE
-              value: "/home/wso2/security/redis/redis-ca.key"
-            - name: REVOKED_TOKEN_CLEANUP_INTERVAL
-              value: "3600"
-            {{- end }}
-          volumeMounts:
-            - name: tmp
-              mountPath: /tmp
-            - name: enforcer-keystore-secret-volume
-              mountPath: /home/wso2/security/keystore/enforcer.key
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certKeyFilename | default "tls.key" }}
-            {{- else }}
-              subPath: tls.key
-            {{- end }}
-            {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled }}
-            - name: prometheus-jmx-config-volume
-              mountPath: /tmp/metrics/prometheus-jmx-config-enforcer.yml
-              subPath: prometheus-jmx-config-enforcer.yml
-            {{- end }}
-            - name: enforcer-keystore-secret-volume
-              mountPath: /home/wso2/security/keystore/enforcer.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: enforcer-keystore-secret-volume
-              mountPath: /home/wso2/security/truststore/apk.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.caCertFileName | default "ca.crt" }}
-            {{- else }}
-              subPath: ca.crt
-            {{- end }}
-            - name: enforcer-keystore-secret-volume
-              mountPath: /home/wso2/security/truststore/enforcer.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: adapter-truststore-secret-volume
-              mountPath: /home/wso2/security/truststore/adapter.crt
-            {{- if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.adapter.deployment.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            # - name: common-controller-truststore-secret-volume
-            #   mountPath: /home/wso2/security/truststore/adapter.pem
-            - name: router-keystore-secret-volume
-              mountPath: /home/wso2/security/truststore/router.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: log-conf-volume
-              mountPath: /home/wso2/conf/
-            - name: enforcer-jwt-secret-volume
-              mountPath: /home/wso2/security/keystore/mg.pem
-              subPath: mg.pem
-            - name: enforcer-jwt-secret-volume
-              mountPath: /home/wso2/security/truststore/mg.pem
-              subPath: mg.pem
-            - name: enforcer-jwt-secret-volume
-              mountPath: /home/wso2/security/keystore/mg.key
-              subPath: mg.key
-            - name: enforcer-trusted-certs
-              mountPath: /home/wso2/security/truststore/wso2carbon.pem
-              subPath: wso2carbon.pem
-            - name: enforcer-apikey-cert
-              mountPath: /home/wso2/security/truststore/wso2-apim-carbon.pem
-              subPath: wso2-apim-carbon.pem
-            - name: idp-certificate-secret-volume
-              mountPath: /home/wso2/security/truststore/idp.pem
-            {{ if and .Values.wso2.apk.idp.signing .Values.wso2.apk.idp.signing.fileName }}
-              subPath: {{ .Values.wso2.apk.idp.signing.fileName }}
-            {{ else }}
-              subPath: wso2carbon.pem
-            {{ end }}
-            {{ if and .Values.wso2.apk.idp.tls .Values.wso2.apk.idp.tls.fileName }}
-            - name: idp-tls-certificate-secret-volume
-              mountPath: /home/wso2/security/truststore/idp-tls.pem
-              subPath: {{ .Values.wso2.apk.idp.tls.fileName }}
-            {{ end }}
-          readinessProbe:
-            exec:
-              command: [ "sh", "check_health.sh" ]
-            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.readinessProbe.initialDelaySeconds }}
-            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.readinessProbe.periodSeconds }}
-            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.readinessProbe.failureThreshold }}
-          livenessProbe:
-            exec:
-              command: [ "sh", "check_health.sh" ]
-            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.livenessProbe.initialDelaySeconds }}
-            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.livenessProbe.periodSeconds }}
-            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.livenessProbe.failureThreshold }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-        - name: router
-          image: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.image }}
-          imagePullPolicy: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.imagePullPolicy }}
-          ports:
-            {{ if and .Values.wso2.apk.dp.gateway.httpListener .Values.wso2.apk.dp.gateway.httpListener.enabled }}
-            - containerPort: {{ .Values.wso2.apk.dp.gateway.httpListener.port | default 9080}}
-              protocol: "TCP"
-            {{ end }}
-            - containerPort: 9095
-              protocol: "TCP"
-            - containerPort: 9090
-              protocol: "TCP"
-            - containerPort: 9091
-              protocol: "TCP"
-            - containerPort: 9000
-              protocol: "TCP"
-{{ include "apk-helm.deployment.resources" .Values.wso2.apk.dp.gatewayRuntime.deployment.router.resources | indent 10 }}
-{{ include "apk-helm.deployment.env" .Values.wso2.apk.dp.gatewayRuntime.deployment.router.env | indent 10 }}
-            - name: ADAPTER_HOST_NAME
-              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
-            - name: ADAPTER_HOST
-              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
-            - name: ENFORCER_HOST
-              value: "127.0.0.1"
-            - name: ENFORCER_ANALYTICS_HOST
-              value: "127.0.0.1"
-            - name: ROUTER_ADMIN_HOST
-              value: "0.0.0.0"
-            - name: ROUTER_ADMIN_PORT
-              value: "9000"
-            - name: ROUTER_PORT
-              value: "9095"
-            - name: ROUTER_CLUSTER
-              value: "apk_router_cluster"
-            - name: ROUTER_LABEL
-              value: {{ .Values.wso2.apk.dp.gateway.name | default "wso2-apk-default" }}
-            - name: ROUTER_PRIVATE_KEY_PATH
-              value: "/home/wso2/security/keystore/router.key"
-            - name: ROUTER_PUBLIC_CERT_PATH
-              value: "/home/wso2/security/keystore/router.crt"
-            - name: ADAPTER_PORT
-              value: "18000"
-            - name: ADAPTER_CA_CERT_PATH
-              value: "/home/wso2/security/truststore/adapter.crt"
-            - name: ENFORCER_PORT
-              value: "8081"
-            - name: ENFORCER_ANALYTICS_RECEIVER_PORT
-              value: "18090"
-            - name: ENFORCER_CA_CERT_PATH
-              value: "/home/wso2/security/truststore/enforcer.crt"
-            - name: CONCURRENCY
-              value: "2"
-          volumeMounts:
-            - name: router-keystore-secret-volume
-              mountPath: /home/wso2/security/keystore/router.key
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certKeyFilename | default "tls.key" }}
-            {{- else }}
-              subPath: tls.key
-            {{- end }}
-            - name: router-keystore-secret-volume
-              mountPath: /home/wso2/security/keystore/router.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: adapter-truststore-secret-volume
-              mountPath: /home/wso2/security/truststore/adapter.crt
-            {{- if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.adapter.deployment.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: enforcer-keystore-secret-volume
-              mountPath: /home/wso2/security/truststore/enforcer.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: log-conf-volume
-              mountPath: /home/wso2/conf/
-            {{ if and .Values.wso2.apk.dp.enabled .Values.wso2.apk.dp.ratelimiter.enabled }}
-            - name: ratelimiter-truststore-secret-volume
-              mountPath: /home/wso2/security/truststore/ratelimiter.crt
-            {{- if and .Values.wso2.apk.dp.ratelimiter.deployment.configs .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: ratelimiter-truststore-secret-volume
-              mountPath: /home/wso2/security/truststore/ratelimiter-ca.crt
-            {{- if and .Values.wso2.apk.dp.ratelimiter.deployment.configs .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls.certCAFilename | default "ca.crt" }}
-            {{- else }}
-              subPath: ca.crt
-            {{- end }}
-            {{ end }}
-          livenessProbe:
-            exec:
-              command: [ "sh", "router_check_health.sh", "health" ]
-            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.livenessProbe.initialDelaySeconds }}
-            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.livenessProbe.periodSeconds }}
-            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.livenessProbe.failureThreshold }}
-          readinessProbe:
-            exec:
-              command: [ "sh", "router_check_health.sh", "ready" ]
-            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.initialDelaySeconds }}
-            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.periodSeconds }}
-            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.failureThreshold }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-          startupProbe:
-            exec:
-              command: [ "sh", "router_check_health.sh", "ready" ]
-            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.initialDelaySeconds }}
-            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.periodSeconds }}
-            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.failureThreshold }}
-      {{- if and .Values.wso2.subscription .Values.wso2.subscription.imagePullSecrets}}
-      imagePullSecrets:
-        - name: {{ .Values.wso2.subscription.imagePullSecrets }}
-      {{ end }}
-      securityContext:
-        seccompProfile:
-          type: "RuntimeDefault"
-      volumes:
-      {{ if and .Values.wso2.apk.dp.enabled .Values.wso2.apk.dp.ratelimiter.enabled }}
-        - name: ratelimiter-truststore-secret-volume
-          secret:
-            {{- if and .Values.wso2.apk.dp.ratelimiter.deployment.configs .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls }}
-            secretName: {{ .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls.certificatesSecret | default (printf "%s-ratelimiter-server-cert" (include "apk-helm.resource.prefix" .)) }}
-          {{- else }}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-ratelimiter-server-cert
-          {{- end }}
-      {{ end }}
-        # - name: common-controller-truststore-secret-volume
-        #   secret:
-        #   {{- if and .Values.wso2.apk.dp.commonController.configs .Values.wso2.apk.dp.commonController.configs.tls }}
-        #     secretName: {{ .Values.wso2.apk.dp.commonController.configs.tls.secretName | default (printf "%s-common-controller-server-cert" (include "apk-helm.resource.prefix" .)) }}
-        #   {{- else }}
-        #     secretName: {{ template "apk-helm.resource.prefix" . }}-common-controller-server-cert
-        #   {{- end }}
-        #     defaultMode: 420
-        {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled }}
-        - name: prometheus-jmx-config-volume
-          configMap: 
-            name: prometheus-jmx-config-enforcer
-        {{- end }}
-        - name: enforcer-keystore-secret-volume
-          secret: 
-          {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-            secretName: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certificatesSecret | default (printf "%s-enforcer-server-cert" (include "apk-helm.resource.prefix" .)) }}
-          {{- else }}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-server-cert
-          {{- end }}
-        - name: log-conf-volume
-          configMap: 
-            name: {{ template "apk-helm.resource.prefix" . }}-log-conf
-        - name: router-keystore-secret-volume
-          secret: 
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
-            secretName: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certificatesSecret | default (printf "%s-gateway-server-cert" (include "apk-helm.resource.prefix" .)) }}
-          {{- else }}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-gateway-server-cert
-          {{- end }}
-        - name: adapter-truststore-secret-volume
-          secret: 
-          {{- if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.tls }}
-            secretName: {{ .Values.wso2.apk.dp.adapter.deployment.configs.tls.secretName | default (printf "%s-adapter-server-cert" (include "apk-helm.resource.prefix" .)) }}
-          {{- else }}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-adapter-server-cert
-          {{- end }}
-        - name: enforcer-jwt-secret-volume
-          secret: 
-            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret
-        - name: enforcer-trusted-certs
-          secret: 
-            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret 
-        - name: enforcer-apikey-cert
-          secret: 
-            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret 
-        - name: idp-certificate-secret-volume
-          secret:
-          {{ if and .Values.wso2.apk.idp.signing .Values.wso2.apk.idp.signing.secretName }}
-            secretName: {{ .Values.wso2.apk.idp.signing.secretName }}
-            {{else}}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret
-          {{ end}}
-          {{ if and .Values.wso2.apk.idp.tls .Values.wso2.apk.idp.tls.secretName }}
-        - name: idp-tls-certificate-secret-volume
-          secret:
-            secretName: {{ .Values.wso2.apk.idp.tls.secretName }}
-          {{ end }}
-        - name: tmp
-          emptyDir: {}
-          {{end}}
diff --git a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-service.yaml b/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-service.yaml
deleted file mode 100644
index 0173aed7a..000000000
--- a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-service.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-# Copyright (c) 2022, WSO2 LLC. (https://www.wso2.com) All Rights Reserved.
-#
-# WSO2 LLC. licenses this file to you under the Apache License,
-# Version 2.0 (the "License"); you may not use this file except
-# in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-{{- if .Values.wso2.apk.dp.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ template "apk-helm.resource.prefix" . }}-gateway-service
-  namespace : {{ .Release.Namespace }}
-{{if and .Values.wso2.apk.dp.gatewayRuntime.service .Values.wso2.apk.dp.gatewayRuntime.service.annotations }}
-  annotations:
-{{ toYaml .Values.wso2.apk.dp.gatewayRuntime.service.annotations | indent 4 }}
-{{ end }}
-spec:
-  type: {{ .Values.wso2.apk.dp.gateway.service.type | default "LoadBalancer" }}
-  # label keys and values that must match in order to receive traffic for this service
-  selector:
-{{ include "apk-helm.pod.selectorLabels" (dict "root" . "app" "gateway" ) | indent 4}}
-  ports:
-{{ if and .Values.wso2.apk.dp.gateway.httpListener .Values.wso2.apk.dp.gateway.httpListener.enabled }}
-  - name: "http-endpoint"
-    protocol: TCP
-    port: {{ .Values.wso2.apk.dp.gateway.httpListener.port | default 9080 }}
-{{ end }}
-  - name: "https-endpoint"
-    protocol: TCP
-    port: 9095
-{{- end -}}
diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index f034acbe5..55052640b 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -10,6 +10,7 @@ data:
       {{- if and .Values.wso2.apk.dp.environment .Values.wso2.apk.dp.environment.name }}
       environment = "{{ .Values.wso2.apk.dp.environment.name }}"
       {{- end }}
+      namespace = "{{ .Release.Namespace }}"
     {{ if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces }}
     [adapter.operator]
       namespaces = [{{ include "commaJoinedQuotedList" .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces}}]
@@ -32,6 +33,7 @@ data:
 
     {{ if and .Values.wso2.apk.dp.gatewayRuntime.deployment .Values.wso2.apk.dp.gatewayRuntime.deployment.router .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs }}
     [router]
+      namespace = "{{ .Release.Namespace }}"
       {{ if .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.systemHost }}
       systemHost = "{{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.systemHost }}"
       {{ end }}
diff --git a/helm-charts/templates/serviceAccount/apk-cluster-role.yaml b/helm-charts/templates/serviceAccount/apk-cluster-role.yaml
index ccbb849a5..8b090ca0e 100644
--- a/helm-charts/templates/serviceAccount/apk-cluster-role.yaml
+++ b/helm-charts/templates/serviceAccount/apk-cluster-role.yaml
@@ -20,12 +20,21 @@ kind: ClusterRole
 metadata:
   name: {{ .Values.wso2.apk.auth.roleName }}
 rules:
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get","list","watch","update","delete","create"]
   - apiGroups: [""]
-    resources: ["services","configmaps","secrets"]
+    resources: ["services","configmaps","secrets", "namespaces", "serviceaccounts", "events", "nodes"]
     verbs: ["get","list","watch","update","delete","create"]
+  - apiGroups: ["autoscaling"]
+    resources: ["horizontalpodautoscalers"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["httproutes","gateways","gatewayclasses"]
-    verbs: ["get","list","watch","update","delete","create"]
+    resources: ["httproutes","gateways","gatewayclasses", "referencegrants"]
+    verbs: ["get","list","watch","update","delete","create", "patch"]
   - apiGroups: [ "gateway.networking.k8s.io" ]
     resources: [ "gateways/status","gatewayclasses/status","httproutes/status" ]
     verbs: [ "get","patch","update" ]

From 4e3371011c9632fe276bd9785ae5a81dcf7ce6f2 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 5 Aug 2024 14:41:42 +0530
Subject: [PATCH 2/4] add config for gateway deployment

---
 adapter/config/default_config.go              | 34 +++++++-
 adapter/config/types.go                       | 41 ++++++++-
 adapter/internal/adapter/adapter.go           | 42 +++++-----
 .../gateway-api/bootstrap/bootstrap.go        | 15 ++--
 .../operator/gateway-api/crypto/certgen.go    |  2 +-
 .../infrastructure/kubernetes/infra.go        | 25 +-----
 .../kubernetes/proxy/resource.go              | 84 ++++++-------------
 .../kubernetes/proxy/resource_provider.go     |  2 +-
 .../provider/kubernetes/controller.go         |  2 +-
 .../provider/kubernetes/predicates.go         |  3 -
 .../gateway-api/translator/runner/runner.go   | 46 ----------
 .../operator/gateway-api/xds/runner/runner.go | 10 +--
 .../gateway-api/xds/runner/runner_test.go     |  8 +-
 adapter/pkg/health/health.go                  |  4 +-
 adapter/resources/check_health.sh             |  2 +-
 gateway/enforcer/Dockerfile                   | 12 ---
 .../gateway-components/log-conf.yaml          | 12 ++-
 helm-charts/values.yaml                       | 12 +--
 18 files changed, 156 insertions(+), 200 deletions(-)

diff --git a/adapter/config/default_config.go b/adapter/config/default_config.go
index 51bb47424..8ed335bad 100644
--- a/adapter/config/default_config.go
+++ b/adapter/config/default_config.go
@@ -31,7 +31,6 @@ var defaultConfig = &Config{
 		Operator: operator{
 			Namespaces: nil,
 		},
-		Namespace:   "apk",
 		Environment: "Default",
 		Metrics: Metrics{
 			Enabled: false,
@@ -49,7 +48,6 @@ var defaultConfig = &Config{
 		},
 	},
 	Envoy: envoy{
-		Namespace:         "apk",
 		ListenerCodecType: "AUTO",
 		// todo(amali) move connect timeout to crd
 		ClusterTimeoutInSeconds:          20,
@@ -275,4 +273,36 @@ var defaultConfig = &Config{
 			"endpoint":               "/api/v2/spans",
 		},
 	},
+	Deployment: deployment{
+		//todo(amali) add validation
+		Gateway: gateway{
+			Namespace:                "apk",
+			AdapterHostName:          "",
+			AdapterHost:              "",
+			CommonControllerHostName: "",
+			CommonControllerHost:     "",
+			EnforcerPrivateKeyPath:   "/home/wso2/security/keystore/enforcer.key",
+			EnforcerPublicCertPath:   "/home/wso2/security/keystore/enforcer.crt",
+			EnforcerServerName:       "",
+			AdapterTrustedCAPath:     "/home/wso2/security/truststore",
+			AdapterXDSPort:           "18000",
+			CommonControllerXDSPort:  "18002",
+			CommonControllerRestPort: "18003",
+			EnforcerLabel:            "wso2-apk-default",
+			EnforcerRegion:           "UNKNOWN",
+			EnforcerXDSMaxMsgSize:    "4194304",
+			EnforcerXDSMaxRetries:    "3",
+			JavaOpts:                 "-Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2",
+			Volumes: volumes{
+				RatelimiterTruststoreSecretVolume: "",
+				EnforcerKeystoreSecretVolume:      "",
+				RouterKeystoreSecretVolume:        "",
+				AdapterTruststoreSecretVolume:     "",
+				EnforcerJwtSecretVolume:           "",
+				EnforcerTrustedCerts:              "",
+				EnforcerApikeyCert:                "",
+				IDPCertificateSecretVolume:        "",
+			},
+		},
+	},
 }
diff --git a/adapter/config/types.go b/adapter/config/types.go
index 329482ad9..9638af9ef 100644
--- a/adapter/config/types.go
+++ b/adapter/config/types.go
@@ -79,6 +79,7 @@ type Config struct {
 	PartitionServer  partitionServer  `toml:"partitionServer"`
 	Analytics        analytics        `toml:"analytics"`
 	Tracing          tracing
+	Deployment       deployment
 }
 
 // Adapter related Configurations
@@ -93,8 +94,6 @@ type adapter struct {
 	Operator operator
 	// Environment of the Adapter
 	Environment string
-	// Namespace of the Adapter
-	Namespace string
 	// Metric represents configurations to expose/export go metrics
 	Metrics Metrics
 	// ControlPlane represents the connection configuration of ControlPlane
@@ -103,8 +102,6 @@ type adapter struct {
 
 // Envoy Listener Component related configurations.
 type envoy struct {
-	// Namespace of the envoyproxy gateway
-	Namespace string
 	// ListenerCodecType Default to AUTO where both http1 and http2 connections are handled
 	// It can be specifically set to either HTTP1 or HTTP2
 	ListenerCodecType string
@@ -318,6 +315,42 @@ type tracing struct {
 	ConfigProperties map[string]string
 }
 
+type deployment struct {
+	Gateway gateway
+}
+
+type gateway struct {
+	Namespace                string
+	AdapterHostName          string
+	AdapterHost              string
+	CommonControllerHostName string
+	CommonControllerHost     string
+	EnforcerPrivateKeyPath   string
+	EnforcerPublicCertPath   string
+	EnforcerServerName       string
+	AdapterTrustedCAPath     string
+	AdapterXDSPort           string
+	CommonControllerXDSPort  string
+	CommonControllerRestPort string
+	EnforcerLabel            string
+	EnforcerRegion           string
+	EnforcerXDSMaxMsgSize    string
+	EnforcerXDSMaxRetries    string
+	JavaOpts                 string
+	Volumes                  volumes
+}
+
+type volumes struct {
+	RatelimiterTruststoreSecretVolume string
+	EnforcerKeystoreSecretVolume      string
+	RouterKeystoreSecretVolume        string
+	AdapterTruststoreSecretVolume     string
+	EnforcerJwtSecretVolume           string
+	EnforcerTrustedCerts              string
+	EnforcerApikeyCert                string
+	IDPCertificateSecretVolume        string
+}
+
 // Metrics defines the configuration for metrics collection.
 type Metrics struct {
 	Enabled bool
diff --git a/adapter/internal/adapter/adapter.go b/adapter/internal/adapter/adapter.go
index 4b696d5e9..7c46efcd9 100644
--- a/adapter/internal/adapter/adapter.go
+++ b/adapter/internal/adapter/adapter.go
@@ -140,67 +140,67 @@ func runManagementServer(conf *config.Config, server xdsv3.Server, enforcerServe
 
 func SetupRunners(conf *config.Config) {
 	ctx := ctrl.SetupSignalHandler()
-	// start the operator
-	pResources := new(message.ProviderResources)
-	// Start the Provider Service
-	// It fetches the resources from the configured provider type
+
+	// Step 1: Start the Kubernetes Provider Service
+	// It fetches the resources from the kubernetes
 	// and publishes it
 	// It also subscribes to status resources and once it receives
 	// a status resource back, it writes it out.
+	// Final processed crs will be stored in following pResources.
+	pResources := new(message.ProviderResources)
 	providerRunner := providerrunner.New(&providerrunner.Config{
 		ProviderResources: pResources,
 	})
 	if err := providerRunner.Start(ctx); err != nil {
-		logger.LoggerAPKOperator.Error("Error while starting provider service", err)
+		logger.LoggerAPKOperator.Error("Error while starting provider service ", err)
 	}
 
-	xdsIR := new(message.XdsIR)
-	infraIR := new(message.InfraIR)
-	// Start the GatewayAPI Translator Runner
+	// Step 2: Start the GatewayAPI Translator Runner
 	// It subscribes to the provider resources, translates it to xDS IR
 	// and infra IR resources and publishes them.
+	// Final processed structs will be in pResources, xdsIR, and infraIR
+	xdsIR := new(message.XdsIR)
+	infraIR := new(message.InfraIR)
 	gwRunner := runner.New(&runner.Config{
 		ProviderResources: pResources,
 		XdsIR:             xdsIR,
 		InfraIR:           infraIR,
 	})
 	if err := gwRunner.Start(ctx); err != nil {
-		logger.LoggerAPKOperator.Error("Error while starting translation service", err)
+		logger.LoggerAPKOperator.Error("Error while starting translation service ", err)
 	}
 
-	xds := new(message.Xds)
-	// Start the Xds Translator Service
+	// Step 3: Start the Xds Translator Service
 	// It subscribes to the xdsIR, translates it into xds Resources and publishes it.
+	// Final xds configs are in xds.
+	xds := new(message.Xds)
 	xdsTranslatorRunner := xdstranslatorrunner.New(&xdstranslatorrunner.Config{
-		// Server:            *cfg,
-		XdsIR: xdsIR,
-		Xds:   xds,
-		// ExtensionManager:  extMgr,
+		XdsIR:             xdsIR,
+		Xds:               xds,
 		ProviderResources: pResources,
 	})
 	if err := xdsTranslatorRunner.Start(ctx); err != nil {
-		logger.LoggerAPKOperator.Error("Error while starting xds translator service", err)
+		logger.LoggerAPKOperator.Error("Error while starting xds translator service ", err)
 	}
 
-	// Start the Infra Manager Runner
+	// Step 4: Start the Infra Manager Runner
 	// It subscribes to the infraIR, translates it into Envoy Proxy infrastructure
 	// resources such as K8s deployment and services.
 	infraRunner := infrarunner.New(&infrarunner.Config{
 		InfraIR: infraIR,
 	})
 	if err := infraRunner.Start(ctx); err != nil {
-		logger.LoggerAPKOperator.Error("Error while starting infrastructure service", err)
+		logger.LoggerAPKOperator.Error("Error while starting infrastructure service ", err)
 	}
 
-	// Start the xDS Server
+	// Step 5: Start the xDS Server
 	// It subscribes to the xds Resources and configures the remote Envoy Proxy
 	// via the xDS Protocol.
 	xdsServerRunner := xdsserverrunner.New(&xdsserverrunner.Config{
-		// Server: *cfg,
 		Xds: xds,
 	})
 	if err := xdsServerRunner.Start(ctx); err != nil {
-		logger.LoggerAPKOperator.Error("Error while starting xds service", err)
+		logger.LoggerAPKOperator.Error("Error while starting xds service ", err)
 	}
 }
 
diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
index 9c132361d..1e51b63e1 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
@@ -26,9 +26,11 @@ import (
 	// Register embed
 	_ "embed"
 	"fmt"
+	"strconv"
 	"strings"
 	"text/template"
 
+	"github.com/wso2/apk/adapter/config"
 	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
 	"github.com/wso2/apk/adapter/pkg/utils/regex"
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -37,9 +39,6 @@ import (
 const (
 	// envoyCfgFileName is the name of the Envoy configuration file.
 	envoyCfgFileName = "bootstrap.yaml"
-	// envoyGatewayXdsServerHost is the DNS name of the Xds Server within Envoy Gateway.
-	// It defaults to the Envoy Gateway Kubernetes service.
-	envoyGatewayXdsServerHost = "envoy-gateway"
 	// EnvoyAdminAddress is the listening address of the envoy admin interface.
 	EnvoyAdminAddress = "0.0.0.0"
 	// EnvoyAdminPort is the port used to expose admin interface.
@@ -47,9 +46,6 @@ const (
 	// envoyAdminAccessLogPath is the path used to expose admin access log.
 	envoyAdminAccessLogPath = "/dev/null"
 
-	// DefaultXdsServerPort is the default listening port of the xds-server.
-	DefaultXdsServerPort = 18000
-
 	envoyReadinessAddress = "0.0.0.0"
 	EnvoyReadinessPort    = 19001
 	EnvoyReadinessPath    = "/ready"
@@ -193,12 +189,13 @@ func GetRenderedBootstrapConfig(proxyMetrics *egv1a1.ProxyMetrics) (string, erro
 			}
 		}
 	}
-
+	conf := config.ReadConfigs()
+	xdsport, _ := strconv.Atoi(conf.Deployment.Gateway.AdapterXDSPort)
 	cfg := &bootstrapConfig{
 		parameters: bootstrapParameters{
 			XdsServer: xdsServerParameters{
-				Address: envoyGatewayXdsServerHost,
-				Port:    DefaultXdsServerPort,
+				Address: conf.Deployment.Gateway.AdapterHost,
+				Port:    int32(xdsport),
 			},
 			AdminServer: adminServerParameters{
 				Address:       EnvoyAdminAddress,
diff --git a/adapter/internal/operator/gateway-api/crypto/certgen.go b/adapter/internal/operator/gateway-api/crypto/certgen.go
index 87a8f1bcd..dfc2bd305 100644
--- a/adapter/internal/operator/gateway-api/crypto/certgen.go
+++ b/adapter/internal/operator/gateway-api/crypto/certgen.go
@@ -109,7 +109,7 @@ type certificateRequest struct {
 // and Envoy returning them as a *Certificates struct or error if encountered.
 func GenerateCerts() (*Certificates, error) {
 	conf := config.ReadConfigs()
-	gatewayNs := conf.Envoy.Namespace
+	gatewayNs := conf.Deployment.Gateway.Namespace
 	certCfg := new(Configuration)
 
 	certCfg.getProvider()
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
index de1057994..69da43826 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
@@ -58,7 +58,7 @@ type Infra struct {
 func NewInfra(cli client.Client) *Infra {
 	conf := config.ReadConfigs()
 	return &Infra{
-		Namespace: conf.Envoy.Namespace,
+		Namespace: conf.Deployment.Gateway.Namespace,
 		Client:    New(cli),
 	}
 }
@@ -67,33 +67,10 @@ func NewInfra(cli client.Client) *Infra {
 // provided ResourceRender, if it doesn't exist and updates it if it does.
 func (i *Infra) createOrUpdate(ctx context.Context, r ResourceRender) error {
 
-	// certs, err := crypto.GenerateCerts()
-	// if err != nil {
-	// 	return fmt.Errorf("failed to generate certificates: %w", err)
-	// }
-	// secrets, err := gatewayapi.CreateOrUpdateSecrets(ctx, i.Client.Client, gatewayapi.CertsToSecret(i.Namespace, certs), true)
-
-	// if err != nil {
-	// 	if errors.Is(err, gatewayapi.ErrSecretExists) {
-	// 		loggers.LoggerAPKOperator.Info(err.Error())
-	// 	} else {
-	// 		return fmt.Errorf("failed to create or update secrets: %w", err)
-	// 	}
-	// } else {
-	// 	for i := range secrets {
-	// 		s := secrets[i]
-	// 		loggers.LoggerAPKOperator.Info("created secret", "namespace", s.Namespace, "name", s.Name)
-	// 	}
-	// }
-
 	if err := i.createOrUpdateServiceAccount(ctx, r); err != nil {
 		return fmt.Errorf("failed to create or update serviceaccount %s/%s: %w", i.Namespace, r.Name(), err)
 	}
 
-	// if err := i.createOrUpdateConfigMap(ctx, r); err != nil {
-	// 	return fmt.Errorf("failed to create or update configmap %s/%s: %w", i.Namespace, r.Name(), err)
-	// }
-
 	if err := i.createOrUpdateDeployment(ctx, r); err != nil {
 		return fmt.Errorf("failed to create or update deployment %s/%s: %w", i.Namespace, r.Name(), err)
 	}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index d301e3059..e87d802f1 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -492,44 +492,14 @@ func expectedEnforcerVolumeMounts(containerSpec *egv1a1.KubernetesContainerSpec)
 }
 
 // expectedDeploymentVolumes returns expected proxy deployment volumes.
-func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDeploymentSpec) []corev1.Volume {
+func expectedDeploymentVolumes(deploymentSpec *egv1a1.KubernetesDeploymentSpec) []corev1.Volume {
+	conf := config.ReadConfigs()
 	volumes := []corev1.Volume{
-		// {
-		// 	Name: "certs",
-		// 	VolumeSource: corev1.VolumeSource{
-		// 		Secret: &corev1.SecretVolumeSource{
-		// 			SecretName:  "envoy",
-		// 			DefaultMode: ptr.To[int32](420),
-		// 		},
-		// 	},
-		// },
-		// {
-		// 	Name: "sds",
-		// 	VolumeSource: corev1.VolumeSource{
-		// 		ConfigMap: &corev1.ConfigMapVolumeSource{
-		// 			LocalObjectReference: corev1.LocalObjectReference{
-		// 				Name: ExpectedResourceHashedName(name),
-		// 			},
-		// 			Items: []corev1.KeyToPath{
-		// 				{
-		// 					Key:  SdsCAFilename,
-		// 					Path: SdsCAFilename,
-		// 				},
-		// 				{
-		// 					Key:  SdsCertFilename,
-		// 					Path: SdsCertFilename,
-		// 				},
-		// 			},
-		// 			DefaultMode: ptr.To[int32](420),
-		// 			Optional:    ptr.To(false),
-		// 		},
-		// 	},
-		// },
 		{
 			Name: "ratelimiter-truststore-secret-volume",
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
-					SecretName:  "apk-test-wso2-apk-ratelimiter-server-cert",
+					SecretName:  conf.Deployment.Gateway.Volumes.RatelimiterTruststoreSecretVolume,
 					DefaultMode: ptr.To[int32](420),
 				},
 			},
@@ -539,7 +509,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-enforcer-server-cert",
+					SecretName:  conf.Deployment.Gateway.Volumes.EnforcerKeystoreSecretVolume,
 				},
 			},
 		},
@@ -559,7 +529,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "envoy-cert",
+					SecretName:  conf.Deployment.Gateway.Volumes.RouterKeystoreSecretVolume,
 				},
 			},
 		},
@@ -568,7 +538,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-adapter-server-cert",
+					SecretName:  conf.Deployment.Gateway.Volumes.AdapterTruststoreSecretVolume,
 				},
 			},
 		},
@@ -577,7 +547,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-enforcer-keystore-secret",
+					SecretName:  conf.Deployment.Gateway.Volumes.EnforcerJwtSecretVolume,
 				},
 			},
 		},
@@ -586,7 +556,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+					SecretName:  conf.Deployment.Gateway.Volumes.EnforcerTrustedCerts,
 				},
 			},
 		},
@@ -595,7 +565,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+					SecretName:  conf.Deployment.Gateway.Volumes.EnforcerApikeyCert,
 				},
 			},
 		},
@@ -604,7 +574,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+					SecretName:  conf.Deployment.Gateway.Volumes.IDPCertificateSecretVolume,
 				},
 			},
 		},
@@ -651,72 +621,70 @@ func expectedContainerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev
 
 func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.EnvVar {
 	conf := config.ReadConfigs()
-	adapterNs := conf.Adapter.Namespace
-	gatewayNs := conf.Envoy.Namespace
 	env := []corev1.EnvVar{
 		{
 			Name:  "ADAPTER_HOST_NAME",
-			Value: fmt.Sprintf("apk-test-wso2-apk-adapter-service.%s.svc", adapterNs),
+			Value: conf.Deployment.Gateway.AdapterHostName,
 		},
 		{
 			Name:  "ADAPTER_HOST",
-			Value: fmt.Sprintf("apk-test-wso2-apk-adapter-service.%s.svc", adapterNs),
+			Value: conf.Deployment.Gateway.AdapterHost,
 		},
 		{
 			Name:  "COMMON_CONTROLLER_HOST_NAME",
-			Value: fmt.Sprintf("apk-test-wso2-apk-common-controller-service.%s.svc", adapterNs),
+			Value: conf.Deployment.Gateway.CommonControllerHostName,
 		},
 		{
 			Name:  "COMMON_CONTROLLER_HOST",
-			Value: fmt.Sprintf("apk-test-wso2-apk-common-controller-service.%s.svc", adapterNs),
+			Value: conf.Deployment.Gateway.CommonControllerHost,
 		},
 		{
 			Name:  "ENFORCER_PRIVATE_KEY_PATH",
-			Value: "/home/wso2/security/keystore/enforcer.key",
+			Value: conf.Deployment.Gateway.EnforcerPrivateKeyPath,
 		},
 		{
 			Name:  "ENFORCER_PUBLIC_CERT_PATH",
-			Value: "/home/wso2/security/keystore/enforcer.crt",
+			Value: conf.Deployment.Gateway.EnforcerPublicCertPath,
 		},
 		{
 			Name:  "ENFORCER_SERVER_NAME",
-			Value: fmt.Sprintf("apk-test-wso2-apk-enforcer-service.%s.svc", gatewayNs),
+			Value: conf.Deployment.Gateway.EnforcerServerName,
 		},
 		{
 			Name:  "TRUSTED_CA_CERTS_PATH",
-			Value: "/home/wso2/security/truststore",
+			Value: conf.Deployment.Gateway.AdapterTrustedCAPath,
 		},
 		{
 			Name:  "ADAPTER_XDS_PORT",
-			Value: "18000",
+			Value: conf.Deployment.Gateway.AdapterXDSPort,
 		},
 		{
 			Name:  "COMMON_CONTROLLER_XDS_PORT",
-			Value: "18002",
+			Value: conf.Deployment.Gateway.CommonControllerXDSPort,
 		},
 		{
 			Name:  "COMMON_CONTROLLER_REST_PORT",
-			Value: "18003",
+			Value: conf.Deployment.Gateway.CommonControllerRestPort,
 		},
 		{
 			Name:  "ENFORCER_LABEL",
-			Value: "wso2-apk-default",
+			Value: conf.Deployment.Gateway.EnforcerLabel,
 		},
 		{
 			Name:  "ENFORCER_REGION",
-			Value: "UNKNOWN",
+			Value: conf.Deployment.Gateway.EnforcerRegion,
 		},
 		{
 			Name:  "XDS_MAX_MSG_SIZE",
-			Value: "4194304",
+			Value: conf.Deployment.Gateway.EnforcerXDSMaxMsgSize,
 		},
 		{
 			Name:  "XDS_MAX_RETRIES",
-			Value: "3",
+			Value: conf.Deployment.Gateway.EnforcerXDSMaxRetries,
 		},
 		{
 			Name:  "JAVA_OPTS",
-			Value: "-Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2",
+			Value: conf.Deployment.Gateway.JavaOpts,
 		},
 	}
 
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
index 3947f7b5a..e54df5e0b 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
@@ -273,7 +273,7 @@ func (r *ResourceRender) Deployment() (*appsv1.Deployment, error) {
 					SecurityContext:               deploymentConfig.Pod.SecurityContext,
 					Affinity:                      deploymentConfig.Pod.Affinity,
 					Tolerations:                   deploymentConfig.Pod.Tolerations,
-					Volumes:                       expectedDeploymentVolumes(r.infra.Name, deploymentConfig),
+					Volumes:                       expectedDeploymentVolumes(deploymentConfig),
 					ImagePullSecrets:              deploymentConfig.Pod.ImagePullSecrets,
 					NodeSelector:                  deploymentConfig.Pod.NodeSelector,
 					TopologySpreadConstraints:     deploymentConfig.Pod.TopologySpreadConstraints,
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
index de30222c9..db7e35f57 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
@@ -88,7 +88,7 @@ func InitGatewayController(mgr manager.Manager, pResourses *message.ProviderReso
 		statusUpdater: statusUpdater,
 		mgr:           mgr,
 		resources:     pResourses,
-		namespace:     conf.Envoy.Namespace,
+		namespace:     conf.Deployment.Gateway.Namespace,
 		store:         newProviderStore(),
 	}
 	c, err := controller.New(constants.GatewayControllerNew, mgr, controller.Options{Reconciler: r})
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
index 156fb9f3b..91a523564 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
@@ -166,9 +166,6 @@ func (r *gatewayReconcilerNew) envoyDeploymentForGateway(ctx context.Context, ga
 	}
 	deployment := new(appsv1.Deployment)
 	if err := r.client.Get(ctx, key, deployment); err != nil {
-		if k8errors.IsNotFound(err) {
-			return nil, nil
-		}
 		return nil, err
 	}
 	return deployment, nil
diff --git a/adapter/internal/operator/gateway-api/translator/runner/runner.go b/adapter/internal/operator/gateway-api/translator/runner/runner.go
index be0131072..3eedac788 100644
--- a/adapter/internal/operator/gateway-api/translator/runner/runner.go
+++ b/adapter/internal/operator/gateway-api/translator/runner/runner.go
@@ -71,22 +71,6 @@ func (r *Runner) subscribeAndTranslate(ctx context.Context) {
 				// Translate to xds resources
 				t := &translator.Translator{}
 
-				// Set the extension manager if an extension is loaded
-				// if r.ExtensionManager != nil {
-				// 	t.ExtensionManager = &r.ExtensionManager
-				// }
-
-				// Set the rate limit service URL if global rate limiting is enabled.
-				// if r.EnvoyGateway.RateLimit != nil {
-				// 	t.GlobalRateLimit = &translator.GlobalRateLimitSettings{
-				// 		ServiceURL: ratelimit.GetServiceURL(r.Namespace, r.DNSDomain),
-				// 		FailClosed: r.EnvoyGateway.RateLimit.FailClosed,
-				// 	}
-				// 	if r.EnvoyGateway.RateLimit.Timeout != nil {
-				// 		t.GlobalRateLimit.Timeout = r.EnvoyGateway.RateLimit.Timeout.Duration
-				// 	}
-				// }
-
 				result, err := t.Translate(val)
 				if err != nil {
 					loggers.LoggerAPKOperator.Error("Failed to translate xds ir ", err)
@@ -100,38 +84,8 @@ func (r *Runner) subscribeAndTranslate(ctx context.Context) {
 					return
 				}
 
-				// Get all status keys from watchable and save them in the map statusesToDelete.
-				// Iterating through result.EnvoyPatchPolicyStatuses, any valid keys will be removed from statusesToDelete.
-				// Remaining keys will be deleted from watchable before we exit this function.
-				// statusesToDelete := make(map[ktypes.NamespacedName]bool)
-				// for key := range r.ProviderResources.EnvoyPatchPolicyStatuses.LoadAll() {
-				// 	statusesToDelete[key] = true
-				// }
-
-				// // Publish EnvoyPatchPolicyStatus
-				// for _, e := range result.EnvoyPatchPolicyStatuses {
-				// 	key := ktypes.NamespacedName{
-				// 		Name:      e.Name,
-				// 		Namespace: e.Namespace,
-				// 	}
-				// 	// Skip updating status for policies with empty status
-				// 	// They may have been skipped in this translation because
-				// 	// their target is not found (not relevant)
-				// 	if !(reflect.ValueOf(e.Status).IsZero()) {
-				// 		r.ProviderResources.EnvoyPatchPolicyStatuses.Store(key, e.Status)
-				// 	}
-				// 	delete(statusesToDelete, key)
-				// }
-				// // Discard the EnvoyPatchPolicyStatuses to reduce memory footprint
-				// result.EnvoyPatchPolicyStatuses = nil
-
 				// Publish
 				r.Xds.Store(key, result)
-
-				// Delete all the deletable status keys
-				// for key := range statusesToDelete {
-				// 	r.ProviderResources.EnvoyPatchPolicyStatuses.Delete(key)
-				// }
 			}
 		},
 	)
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner.go b/adapter/internal/operator/gateway-api/xds/runner/runner.go
index ffbafca29..b78207444 100644
--- a/adapter/internal/operator/gateway-api/xds/runner/runner.go
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner.go
@@ -25,8 +25,8 @@ package runner
 import (
 	"context"
 	"crypto/tls"
+	"fmt"
 	"net"
-	"strconv"
 	"time"
 
 	"google.golang.org/grpc/keepalive"
@@ -39,8 +39,8 @@ import (
 	runtimev3 "github.com/envoyproxy/go-control-plane/envoy/service/runtime/v3"
 	secretv3 "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
 	serverv3 "github.com/envoyproxy/go-control-plane/pkg/server/v3"
+	"github.com/wso2/apk/adapter/config"
 	"github.com/wso2/apk/adapter/internal/loggers"
-	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/cache"
 	"github.com/wso2/apk/adapter/internal/operator/message"
 	"github.com/wso2/apk/adapter/internal/types"
@@ -106,10 +106,10 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 }
 
 func (r *Runner) serveXdsServer(ctx context.Context) {
-	addr := net.JoinHostPort(XdsServerAddress, strconv.Itoa(bootstrap.DefaultXdsServerPort))
-	l, err := net.Listen("tcp", addr)
+	conf := config.ReadConfigs()
+	l, err := net.Listen("tcp", fmt.Sprintf(":%s", conf.Deployment.Gateway.AdapterXDSPort))
 	if err != nil {
-		loggers.LoggerAPKOperator.Error(err, "failed to listen on port", "address", bootstrap.DefaultXdsServerPort)
+		loggers.LoggerAPKOperator.Error(err, "failed to listen on port", "address", conf.Deployment.Gateway.AdapterXDSPort)
 		return
 	}
 
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner_test.go b/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
index 3dba8c03f..ea2929d53 100644
--- a/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
@@ -27,13 +27,13 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"errors"
+	"fmt"
 	"net"
-	"strconv"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/require"
-	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+	"github.com/wso2/apk/adapter/config"
 )
 
 // func TestTLSConfig(t *testing.T) {
@@ -189,9 +189,9 @@ func peekError(conn net.Conn) error {
 }
 
 func TestServeXdsServerListenFailed(t *testing.T) {
+	conf := config.ReadConfigs()
 	// Occupy the address to make listening failed
-	addr := net.JoinHostPort(XdsServerAddress, strconv.Itoa(bootstrap.DefaultXdsServerPort))
-	l, err := net.Listen("tcp", addr)
+	l, err := net.Listen("tcp", fmt.Sprintf(":%s", conf.Deployment.Gateway.AdapterXDSPort))
 	require.NoError(t, err)
 	defer l.Close()
 
diff --git a/adapter/pkg/health/health.go b/adapter/pkg/health/health.go
index 4f65c16dd..9edaad386 100644
--- a/adapter/pkg/health/health.go
+++ b/adapter/pkg/health/health.go
@@ -58,8 +58,8 @@ type Server struct {
 
 // Check responds the health check client with health status of the Adapter
 func (s Server) Check(ctx context.Context, request *healthservice.HealthCheckRequest) (*healthservice.HealthCheckResponse, error) {
-	logger.LoggerHealth.Debugf("Querying health state for Adapter service \"%s\"", request.Service)
-	logger.LoggerHealth.Debugf("Internal health state map: %v", serviceHealthStatus)
+	// logger.LoggerHealth.Debugf("Querying health state for Adapter service \"%s\"", request.Service)
+	// logger.LoggerHealth.Debugf("Internal health state map: %v", serviceHealthStatus)
 
 	if request.Service == "" {
 		// overall health of the server
diff --git a/adapter/resources/check_health.sh b/adapter/resources/check_health.sh
index 8d5e18abd..93c56cad5 100755
--- a/adapter/resources/check_health.sh
+++ b/adapter/resources/check_health.sh
@@ -15,7 +15,7 @@
 # limitations under the License.
 # -----------------------------------------------------------------------
 
-ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18000}"
+ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18001}"
 ADAPTER_SERVER_NAME="${ADAPTER_SERVER_NAME:-adapter}"
 grpc_health_probe -addr "127.0.0.1:${ADAPTER_XDS_PORT}" \
     -tls \
diff --git a/gateway/enforcer/Dockerfile b/gateway/enforcer/Dockerfile
index f581502c9..59739b9c8 100644
--- a/gateway/enforcer/Dockerfile
+++ b/gateway/enforcer/Dockerfile
@@ -75,18 +75,6 @@ ENV JAVA_OPTS=""
 ENV ENFORCER_HOME=${APK_USER_HOME}
 ARG CHECKSUM_AMD64="7e564681110ee4563637457b91e42f62f96b79618a835bb05ae2305acdcc3db0"
 ARG CHECKSUM_ARM64="3759148e22a494149a4abae269adee0d20c428b966683426e2319f9047da521d"
-ENV ENFORCER_PRIVATE_KEY_PATH=/home/wso2/security/keystore/mg.key
-ENV ENFORCER_PUBLIC_CERT_PATH=/home/wso2/security/keystore/mg.pem
-ENV TRUSTED_CA_CERTS_PATH=/home/wso2/security/truststore
-ENV ADAPTER_HOST_NAME=adapter
-ENV ADAPTER_HOST=adapter
-ENV ADAPTER_XDS_PORT=18001
-ENV COMMON_CONTROLLER_HOST_NAME=common-controller
-ENV COMMON_CONTROLLER_HOST=common-controller
-ENV COMMON_CONTROLLER_XDS_PORT=18002
-ENV ENFORCER_LABEL="default"
-ENV XDS_MAX_MSG_SIZE=4194304
-ENV XDS_MAX_RETRIES=3
 #todo update the connection string
 ENV APPLICATIONINSIGHTS_CONNECTION_STRING=InstrumentationKey=;IngestionEndpoint=https://westus2-2.in.applicationinsights.azure.com/
 
diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index 55052640b..f8ae1dbd9 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -6,11 +6,21 @@ metadata:
   namespace: {{ .Release.Namespace }}
 data:
   config.toml: | 
+
+    [deployment.gateway.volumes]
+      ratelimiterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-ratelimiter-server-cert"
+			enforcerKeystoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-server-cert"
+			routerKeystoreSecretVolume = "envoy-cert"
+			adapterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-adapter-server-cert"
+			enforcerJwtSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret"
+			enforcerTrustedCerts = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+			enforcerApikeyCert = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+			idpCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+
     [adapter]
       {{- if and .Values.wso2.apk.dp.environment .Values.wso2.apk.dp.environment.name }}
       environment = "{{ .Values.wso2.apk.dp.environment.name }}"
       {{- end }}
-      namespace = "{{ .Release.Namespace }}"
     {{ if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces }}
     [adapter.operator]
       namespaces = [{{ include "commaJoinedQuotedList" .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces}}]
diff --git a/helm-charts/values.yaml b/helm-charts/values.yaml
index 79d83dd5c..fa8671daa 100644
--- a/helm-charts/values.yaml
+++ b/helm-charts/values.yaml
@@ -59,7 +59,8 @@ wso2:
       gateway:
         listener:
           hostname: "gw.wso2.com"
-        service: {}
+        service: 
+          type: "NodePort"
           # secretName: "idp-tls"
       # partitionServer:
       #   enabled: false
@@ -124,8 +125,8 @@ wso2:
           image: apk-adapter:1.1.0-SNAPSHOT
           security:
             sslHostname: "adapter"
-        #     logging:
-        #       level: "INFO" # LogLevels can be "DEBG", "FATL", "ERRO", "WARN", "INFO", "PANC"
+          logging:
+            level: "DEBG" # LogLevels can be "DEBG", "FATL", "ERRO", "WARN", "INFO", "PANC"
         # #          logFormat: "TEXT" # Values can be "JSON", "TEXT"
         # configs:
         #   apiNamespaces:
@@ -154,7 +155,7 @@ wso2:
           strategy: RollingUpdate
           replicas: 1
           imagePullPolicy: IfNotPresent
-          image: apk-common-controller:1.1.0-SNAPSHOT
+          image: wso2/apk-common-controller:1.1.0
           security:
             sslHostname: "commoncontroller"
           # configs:
@@ -247,7 +248,8 @@ wso2:
               sslHostname: "enforcer"
 #            logging:
 #              level: DEBUG
-#            configs:
+            configs:
+             javaOpts: "-Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2"
 #              tls:
 #                secretName: "router-cert"
 #                certKeyFilename: ""

From 80727dbbf3a1dcb7ff10097da52c53864250b61b Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 5 Aug 2024 16:16:53 +0530
Subject: [PATCH 3/4] fix config.toml tabs

---
 .../gateway-components/log-conf.yaml          | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index f8ae1dbd9..0d8bfce18 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -6,16 +6,26 @@ metadata:
   namespace: {{ .Release.Namespace }}
 data:
   config.toml: | 
+    [deployment.gateway]
+      namespace = "{{ .Release.Namespace }}"
+      adapterHostName = "{{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc"
+      adapterHost = "{{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc"
+      commonControllerHostName = "{{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc"
+      commonControllerHost = "{{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc"
+      enforcerServerName = "{{ template "apk-helm.resource.prefix" . }}-enforcer-service.{{ .Release.Namespace }}.svc"
+      {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.javaOpts }}
+        javaOpts = "{{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.javaOpts }}"
+      {{- end }}
 
     [deployment.gateway.volumes]
       ratelimiterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-ratelimiter-server-cert"
-			enforcerKeystoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-server-cert"
-			routerKeystoreSecretVolume = "envoy-cert"
-			adapterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-adapter-server-cert"
-			enforcerJwtSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret"
-			enforcerTrustedCerts = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
-			enforcerApikeyCert = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
-			idpCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+      enforcerKeystoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-server-cert"
+      routerKeystoreSecretVolume = "envoy-cert"
+      adapterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-adapter-server-cert"
+      enforcerJwtSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret"
+      enforcerTrustedCerts = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+      enforcerApikeyCert = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+      idpCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
 
     [adapter]
       {{- if and .Values.wso2.apk.dp.environment .Values.wso2.apk.dp.environment.name }}

From 263f632166edb1b2f755fabe9b50e0bbcfeae714 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 5 Aug 2024 16:59:53 +0530
Subject: [PATCH 4/4] fix config

---
 .../templates/data-plane/gateway-components/log-conf.yaml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index 0d8bfce18..c04aa0e7a 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -25,7 +25,7 @@ data:
       enforcerJwtSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret"
       enforcerTrustedCerts = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
       enforcerApikeyCert = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
-      idpCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+      iDPCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
 
     [adapter]
       {{- if and .Values.wso2.apk.dp.environment .Values.wso2.apk.dp.environment.name }}